alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Adware-Win32/EoRezo Reporting"; flow:established,to_server; http.uri; content:"/advert/get"; nocase; pcre:"/\/advert\/get(?:ads|kws)(?:\.cgi)?\?(?:d|[ex]_dp_)id=/i"; reference:md5,b5708efc8b478274df4b03d8b7dbbb26; classtype:pup-activity; sid:2013983; rev:10; metadata:created_at 2011_12_02, deprecation_reason Age, signature_severity Minor, updated_at 2024_01_11, reviewed_at 2024_01_11;)