alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET HUNTING Multiple User-Agent Components in a single UA"; flow:established,to_server; http.user_agent; content:"Compatible|3b 20|"; nocase; content:"Compatible|3b 20|"; nocase; distance:0; content:"MSIE|20|"; nocase; content:"MSIE|20|"; distance:0; nocase; fast_pattern; content:"|20|Windows|20|NT|20|"; nocase; content:"|20|Windows|20|NT|20|"; distance:0; nocase; reference:md5,0fc3d71e211f8d5101311d2800c459f7; classtype:misc-activity; sid:2035396; rev:2; metadata:attack_target Client_Endpoint, created_at 2022_03_03, deployment Perimeter, deprecation_reason Performance, performance_impact Significant, confidence Medium, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_07;)