Rule History

SID: 2022827 • Source: et/open

Versions (4)

Version DetailsCurrent

Rev: 5 • May 18, 2016, 12:00 PM

Message:

ET ADWARE_PUP PUP/DriverRestore Sending System Information to Affiliate

Rule:

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PUP/DriverRestore Sending System Information to Affiliate"; flow:established,to_server; http.uri; content:".jsp?leadTrackerId="; content:"|22|ComputerName|22|"; distance:0; content:"|22|UserName|22|"; distance:0; content:"|22|IsAdmin|22|"; distance:0; http.user_agent; content:"DriverRestore/"; fast_pattern; startswith; http.header_names; content:!"Referer|0d 0a|"; reference:md5,4f7f497668e3e716a6f4a53af0924a25; classtype:pup-activity; sid:2022827; rev:5; metadata:created_at 2016_05_18, deprecation_reason Duplicate, confidence High, signature_severity Minor, updated_at 2023_07_05;)

Created:

May 18, 2016, 12:00 PM

Updated:

Jul 5, 2023, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

May 30, 2025, 12:04 AM

Filename:

rules/emerging-adware_pup.rules