alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/OutBrowse.G Variant Checkin"; flow:to_server,established; http.uri; content:"/dmresources/instructions"; fast_pattern; content:".dat"; http.user_agent; content:"NSISDL/1.2 (Mozilla)"; depth:20; http.protocol; content:"HTTP/1.0"; endswith; http.header_names; content:!"Referer"; reference:md5,d75055c45e2c5293c3e0fbffb299ea6d; classtype:pup-activity; sid:2017992; rev:11; metadata:created_at 2014_01_20, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_17;)