alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MultiPlug.A checkin"; flow:to_server,established; http.uri; content:"get/?ver="; content:"&aid="; distance:0; content:"&hid="; distance:0; content:"&rid="; distance:0; content:"&data="; distance:0; content:"&report="; distance:0; pcre:"/^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=/"; http.header_names; content:!"Referer|0d 0a|"; reference:md5,f9556acf36168414ad7d5650eeee7972; reference:md5,69e28b658520528a1473f51e62698c87; classtype:pup-activity; sid:2018867; rev:4; metadata:created_at 2014_08_01, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_31;)