Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PUP.Win32.BoBrowser User-Agent (BoBrowser)"; flow:established,to_server; http.user_agent; content:"|20|BoBrowser/"; fast_pattern; threshold:type limit,track by_src,count 1,seconds 180; reference:url,malwareprotectioncenter.com/2015/01/20/bobrowser; classtype:pup-activity; sid:2020240; rev:6; metadata:created_at 2015_01_22, confidence High, signature_severity Minor, updated_at 2024_03_11;)