alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Vombanetworks.com Spyware Installer Checkin"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"/scripts/get_cookie.php"; fast_pattern; nocase; http.request_body; content:"vomba="; depth:6; content:"&ff="; content:"&vombashots="; content:"&vombashots_ff="; content:"&hwd="; content:"&ver="; content:"&vinfo=Windows"; classtype:pup-activity; sid:2007870; rev:6; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2024_03_13;)