alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET INFO TeamViewer Dyngate User-Agent"; flow:established,to_server; threshold:type limit, count 1, seconds 120, track by_src; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 6.0|3b 20|DynGate)"; fast_pattern; startswith; reference:url,www.teamviewer.com/index.aspx; classtype:policy-violation; sid:2009475; rev:13; metadata:created_at 2010_07_30, confidence High, signature_severity Informational, updated_at 2024_04_12;)