alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP SoundCloud Downloader Install Beacon"; flow:established,to_server; urilen:10; http.method; content:"POST"; http.uri; content:"/index.php"; http.request_body; content:"&OSversion="; content:"&Slv="; content:"&Sysid="; content:"&Sysid1="; content:"&admin="; content:"&browser="; content:"&exe="; content:"&ffver="; content:"&lang_DfltUser="; content:"&ver="; content:"&ts="; reference:url,blog.malwarebytes.org/online-security/2014/03/soundcloud-downloader-always-read-the-eulas/; reference:md5,2e20e446943ecd01d3a668083d81d1fc; classtype:pup-activity; sid:2018324; rev:4; metadata:attack_target Client_Endpoint, created_at 2014_03_26, deployment Perimeter, signature_severity Minor, tag c2, updated_at 2020_08_31, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)