alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PUP Win32/DownloadGuide.A"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/1/dg/3"; fast_pattern; http.request_body; content:"{|22|BuildId|22 3a|"; content:"|22|Campaign|22|"; content:"|22|TrackBackUrl|22|"; http.content_type; content:"application/json"; startswith; http.header_names; content:!"Referer"; reference:md5,37b91123a58a48975770241445392aeb; classtype:pup-activity; sid:2018513; rev:6; metadata:created_at 2014_06_02, signature_severity Minor, updated_at 2020_08_31;)