ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.

alert http $HOME_NET any -> [!134.170.0.0/16,$EXTERNAL_NET] any (
    msg:"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.";
    flow:established,to_server;
    threshold:type limit,track by_src,count 2,seconds 60;
    http.header;
    content:!"GeoVision";
    http.user_agent;
    content:"|20|MSIE 5."; fast_pattern; nocase;
    http.host;
    content:!".microsoft.com"; endswith;
    content:!".trendmicro.com"; endswith;
    content:!".sony.net"; endswith;
    content:!".weather.com"; endswith;
    content:!".yahoo.com"; endswith;
    content:!".dellfix.com"; endswith;
    content:!".oncenter.com"; endswith;
    classtype:policy-violation;
    sid:2016870; rev:15;
    metadata:created_at 2013_05_21, confidence High, signature_severity Informational, updated_at 2020_09_17;
)