alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Tool.InstallToolbar.24 Reporting"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/cr_confirm.asmx/GetXMLLog?"; nocase; content:"TbId="; nocase; content:"TUID="; nocase; content:"Action_Type="; nocase; reference:url,virustotal.com/file-scan/report.html?id=1439d4061659a8534435352274b72dc2fe03c3deeb84e32fc90d40380c35cab1-1322189076; classtype:pup-activity; sid:2014060; rev:6; metadata:created_at 2012_01_02, signature_severity Minor, updated_at 2020_08_31;)