alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/SmartTab PUP Install Activity"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/ins_proc.asp?kind="; fast_pattern; content:"&ist_yn="; content:"&ptn_name="; http.user_agent; content:"tabtoolbarup"; startswith; reference:url,camas.comodo.com/cgi-bin/submit?file=31c027c13105e23af64b1b02882fb2b8300fdf7f511bb4c63c71f9b09c75dd6c; reference:md5,8eaf3b7b72a9af5a85d01b674653ccac; classtype:pup-activity; sid:2014117; rev:6; metadata:created_at 2012_01_12, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_02;)