alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Update attempt for 🎩 Nikto 👨‍💻"; flow:to_server, stateless; http.header; content:"User-Agent|3a 20 0d 0a|"; fast_pattern; http.host.raw; content:"cirt.net"; endswith; nocase; http.uri; content:"/nikto"; reference:url,https://cirt.net/nikto2; metadata:created_at 2022_11_24, updated_at 2022_11_24; sid:3300100; rev:1; classtype:policy-violation;)