alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Tibs Checkin"; flow:established,to_server; http.uri; content:"/adv/"; nocase; content:".php?a1="; nocase; content:"&a2=Type of Processor|3a|"; fast_pattern; nocase; content:"&a3=Windows version is|20|"; nocase; content:"&a4=Build|3a|"; nocase; reference:md5,65448c8678f03253ef380c375d6670ce; classtype:pup-activity; sid:2002955; rev:10; metadata:created_at 2010_07_30, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_06_17;)