alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Sidelinker.com-Upspider.com Spyware Count"; flow:established,to_server; content:"/Pro/cnt.php?mac="; nocase; http_uri; content:"&key="; nocase; http_uri; content:"&pid="; nocase; http_uri; pcre:"/\/Pro\/cnt\.php\?mac=\d\d-\d\d-\d\d-\d\d-\d\d-\d\d\&key=\d+/Ui"; classtype:pup-activity; sid:2008158; rev:6; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2019_08_14;)