Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin 4"; flow:established,to_server; http.request_body; content:"a="; depth:2; content:"&c="; distance:0; content:"&r="; distance:0; pcre:"/^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$/"; http.request_line; content:"POST /u/"; depth:8; fast_pattern; http.connection; content:"Close"; nocase; depth:5; endswith; http.content_type; content:"application/x-www-form-urlencoded"; depth:33; endswith; http.header_names; content:!"Accept"; content:!"Referer|0d 0a|"; nocase; reference:md5,3ea75d62966f8c52de16d7849eeb3691; classtype:pup-activity; sid:2022723; rev:5; metadata:created_at 2016_04_11, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_05;)