Rule History

SID: 2022807 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 4 • May 16, 2016, 12:00 PM

Message:

ET ADWARE_PUP Win32/InstallCore Initial Install Activity 1

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/InstallCore Initial Install Activity 1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?v="; depth:4; content:"&subver="; fast_pattern; distance:0; content:"&pcrc="; distance:0; pcre:"/^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$/"; http.header_names; content:!"Accept-"; content:!"Referer"; reference:md5,0a6a0baf77b80706cab665754ecadac9; classtype:pup-activity; sid:2022807; rev:4; metadata:created_at 2016_05_16, signature_severity Minor, updated_at 2020_08_31;)

Created:

May 16, 2016, 12:00 PM

Updated:

Aug 31, 2020, 12:00 PM

DB Created:

May 16, 2016, 12:00 PM

DB Updated:

Sep 10, 2024, 1:01 PM

Filename:

rules/emerging-adware_pup.rules