alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP W32/SearchSuite Install CnC Beacon"; flow:established,to_server; urilen:23; http.method; content:"POST"; http.uri; content:"/install_statistics.php"; fast_pattern; depth:23; http.user_agent; content:"Mozilla/4.0 (compatible|3B 20|MSIE|3B 20|Win32)"; startswith; http.request_body; content:"XML="; depth:4; http.header_names; content:!"Referer|0d 0a|"; reference:md5,7203a56c3888e819c602e758fce823fa; reference:md5,77e33e8a53e2a0dbc06c921de9b71142; classtype:pup-activity; sid:2018753; rev:4; metadata:attack_target Client_Endpoint, created_at 2014_07_23, deployment Perimeter, signature_severity Minor, tag c2, updated_at 2020_08_31, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;)