alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware Related User-Agent (UtilMind HTTPGet)"; flow:to_server,established; threshold:type limit, count 1, track by_src, seconds 360; http.header; content:"UtilMind HTTPGet"; fast_pattern; http.host; content:!"www.blueocean.com"; content:!"www.backupmaker.com"; content:!"promo.ascomp.de"; content:!"www.synchredible.com"; content:!"support.numarasoftware.com"; reference:url,www.websearch.com; classtype:pup-activity; sid:2002402; rev:25; metadata:created_at 2010_07_30, confidence High, signature_severity Minor, updated_at 2020_10_30;)