alert http $EXTERNAL_NET any -> any any (msg:"ET USER_AGENTS SAP CVE-2020-6287 PoC UA Observed"; flow:established,to_server; http.user_agent; content:"CVE-2020-6287|20|PoC"; endswith; fast_pattern; reference:url,github.com/chipik/SAP_RECON/blob/master/RECON.py; classtype:attempted-recon; sid:2030548; rev:1; metadata:created_at 2020_07_16, cve CVE_2020_6287, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_07_16;)