Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MALWARE W32/WinWrapper.Adware User-Agent"; flow:established,to_server; http.user_agent; content:"WinWrapper"; depth:10; http.header_names; content:!"Referer|0d 0a|"; reference:md5,2d71e44c02784d579fb4af18bbbeae6c; classtype:pup-activity; sid:2020629; rev:6; metadata:created_at 2015_03_06, confidence High, signature_severity Minor, updated_at 2020_08_31;)