alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Trojan.FakeAV.SystemDefender Checkin"; flow:established,to_server; http.method; content:"GET"; depth:3; http.uri; content:".php?"; nocase; content:"action=stat&wmid="; nocase; content:"&event="; nocase; content:"&uid="; nocase; content:"&i1"; nocase; content:"&i2"; nocase; reference:md5,4d1df7240837832853c8b87606f3dfc2; classtype:pup-activity; sid:2008732; rev:7; metadata:created_at 2010_07_30, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_31;)