alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Gator Agent Traffic"; flow:established,to_server; http.user_agent; content:"Gator/"; depth:6; classtype:pup-activity; sid:2000026; rev:41; metadata:created_at 2010_07_30, deprecation_reason Age, signature_severity Minor, updated_at 2024_02_28, reviewed_at 2024_02_28;)