ET HUNTING Suspicious Malformed Double Accept Header

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET HUNTING Suspicious Malformed Double Accept Header";
    flow:established,to_server;
    http.user_agent;
    content:!"-DRM";
    http.host;
    content:!"buhphone.ru";
    content:!"www.backupmaker.com";
    content:!"ati.com";
    content:!"amd.com"; endswith;
    http.accept;
    content:"Accept|3a 20|"; fast_pattern;
    classtype:policy-violation;
    sid:2008975; rev:18;
    metadata:created_at 2010_07_30, confidence Medium, signature_severity Informational, updated_at 2020_09_16;
)