alert tcp $EXTERNAL_NET 20 -> $HOME_NET any (msg:"ET ADWARE_PUP Abox Download"; flow:established,to_server; content:"|5c 00 43 00 61 00 72 00 6d 00 65 00 6e 00 00 00 16 00 00 00 73 00 75 00 63|"; nocase; offset:160; depth:26; classtype:pup-activity; sid:2001440; rev:8; metadata:created_at 2010_07_30, confidence High, signature_severity Minor, updated_at 2019_08_14;)