Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET RETIRED AlphabetSoup Adware Extension CnC Checkin"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/installLog.php?scheme="; startswith; content:"cpuid="; content:"chromeLog="; content:"ffLog="; content:"operaLog="; content:"foundBefore="; content:"notAdmin="; content:"winVer="; content:"user="; content:"defBrowser="; fast_pattern; content:"uniID="; content:"partner="; content:"startid="; content:"execid="; content:"vbdg="; http.header_names; content:!"Referer"; reference:url,blog.zimperium.com/abc-soup-the-malicious-adware-extension-with-350-variants; classtype:trojan-activity; sid:2037741; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_07_11, deployment Perimeter, deployment SSLDecrypt, former_category ADWARE_PUP, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_04_17, reviewed_at 2025_04_17;)