ET HUNTING Suspicious Empty User-Agent

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET HUNTING Suspicious Empty User-Agent";
    flow:to_server,established;
    http.header;
    content:"User-Agent|3a 20 0d 0a|";
    http.host;
    content:!"connectivitycheck.gstatic.com"; endswith;
    content:!".mcafee.com";
    content:!"deezer.com"; endswith;
    content:!"googlezip.net";
    content:!"metrics.tbliab.net"; endswith;
    content:!"dajax.com"; endswith;
    content:!"update.eset.com"; endswith;
    content:!".sketchup.com"; endswith;
    content:!".yieldmo.com"; endswith;
    content:!"ping-start.com"; endswith;
    content:!".bluekai.com";
    content:!".stockstracker.com";
    content:!".doubleclick.net";
    content:!".pingstart.com";
    content:!".colis-logistique.com";
    content:!"android-lrcresource.wps.com";
    content:!"track.package-buddy.com";
    content:!"talkgadget.google.com"; endswith;
    content:!".visualstudio.com"; endswith;
    content:!".slack-edge.com"; endswith;
    content:!".slack.com"; endswith;
    content:!".lifesizecloud.com"; endswith;
    classtype:unknown;
    sid:2007994; rev:24;
    metadata:affected_product Any, attack_target Client_Endpoint, created_at 2010_07_30, deployment Perimeter, confidence Medium, signature_severity Major, tag User_Agent, updated_at 2022_12_28;
)