alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Freeze.com Spyware/Adware (Install)"; flow:to_server,established; http.uri; content:"/checkhttp.htm"; nocase; http.header; content:"freeze.com"; nocase; http.user_agent; content:"Wise"; nocase; depth:4; classtype:pup-activity; sid:2002840; rev:9; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2020_10_17;)