alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP 2020search/PowerSearch Toolbar Adware/Spyware - GET"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"IpAddr="; nocase; content:"&OS="; nocase; content:"&RegistryChanged="; nocase; content:"&RegistryUpdate="; nocase; content:"&NewInstallation="; nocase; content:"&utilMissing="; nocase; content:"&Basedir="; nocase; content:"&BundleID="; nocase; content:"&InitInstalled="; nocase; content:"&Interval="; nocase; content:"&LastInitRun="; nocase; content:"&LastInitVer="; nocase; content:"&LastSrngRun="; nocase; content:"&LastUtilRun="; nocase; content:"&SrngInstalled="; nocase; content:"&SrngVer="; nocase; content:"&UtilInstalled="; nocase; content:"&UtilVer="; nocase; content:"&PCID"; nocase; reference:url,vil.nai.com/vil/content/v_103738.htm; reference:url,www.sunbeltsecurity.com/ThreatDisplay.aspx?tid=13811&cs=1437A28B7A90C4C502B683CE6DE23C4E; reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-111918-0210-99; classtype:pup-activity; sid:2009807; rev:7; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2020_08_31;)