ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET USER_AGENTS Suspicious User Agent (Microsoft Internet Explorer)";
    flow:established,to_server;
    threshold:type limit, track by_src, count 2, seconds 360;
    http.user_agent;
    content:"Microsoft Internet Explorer"; depth:28;
    http.host;
    content:!"bbc.co.uk";
    content:!"vmware.com";
    content:!"rc.itsupport247.net";
    content:!"msn.com";
    content:!"msn.es";
    content:!"live.com";
    content:!"gocyberlink.com";
    content:!"ultraedit.com";
    content:!"windowsupdate.com";
    content:!"cyberlink.com";
    content:!"lenovo.com";
    content:!"itsupport247.net";
    content:!"msn.co.uk";
    content:!"support.weixin.qq.com";
    classtype:trojan-activity;
    sid:2002400; rev:37;
    metadata:created_at 2010_07_30, confidence High, signature_severity Major, updated_at 2020_08_31;
)