alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP overtls.com adware request"; flow:to_server,established; http.uri; content:"/sidebar.asp?bn=0&qy="; http.header; content:"EmbeddedWB"; classtype:pup-activity; sid:2012693; rev:5; metadata:created_at 2011_04_19, signature_severity Minor, updated_at 2020_08_31;)