Rule History

SID: 2018867 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 4 • Aug 1, 2014, 12:00 PM

Message:

ET ADWARE_PUP MultiPlug.A checkin

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MultiPlug.A checkin"; flow:to_server,established; http.uri; content:"get/?ver="; content:"&aid="; distance:0; content:"&hid="; distance:0; content:"&rid="; distance:0; content:"&data="; distance:0; content:"&report="; distance:0; pcre:"/^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=/"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,f9556acf36168414ad7d5650eeee7972; reference:md5,69e28b658520528a1473f51e62698c87; classtype:pup-activity; sid:2018867; rev:4; metadata:created_at 2014_08_01, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_31;)

Created:

Aug 1, 2014, 12:00 PM

Updated:

Aug 31, 2020, 12:00 PM

DB Created:

Aug 1, 2014, 12:00 PM

DB Updated:

Oct 16, 2025, 8:36 PM

Filename:

rules/emerging-adware_pup.rules