We are officially releasing the Flame signature in Tuesday’s ( June 5th ) release. We are doing further fidelity tests over the weekend, but if you wish to apply this signature early, here is the signature as a custom.
service-http
header-regex [uU][Ss][Ee][Rr][-][aA][Gg][Ee][Nn][Tt][:]\x20Mozilla\x2f4[.]0\x20[(]compatible[;]\x20MSIE\x206[.]0[;]\x20Windows\x20NT\x205[.]1[;]\x20[.]NET\x20CLR\x201[.]1[.]2150[)]
service-ports #WEBPORTS