alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PUP Win32.SoftPulse Retrieving data"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/maxpower-static/templates/"; depth:27; http.header_names; content:!"Referer"; reference:md5,4aa02ca6a3f04cf445924a6d657d10e5; classtype:pup-activity; sid:2019143; rev:7; metadata:created_at 2014_07_22, signature_severity Minor, updated_at 2020_08_31;)