alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MultiPlug.J Checkin"; flow:established,to_server; urilen:>103; http.method; content:!"POST"; http.uri; content:"/?q="; fast_pattern; pcre:"/^\/(?:[A-Za-z]+\d?\/)?\?q=(?=[a-z0-9+/]*[A-Z])(?=[A-Z0-9+/]*[a-z])(?=[A-Za-z0-9+/\x25]*\d)[A-Za-z0-9+/\x25]{100}/"; http.host; content:!"map24.com"; content:!"aptrk.com"; http.header_names; bsize:30; content:!"|0d 0a|Accept-"; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Accept|0d 0a|User-Agent|0d 0a|Host|0d 0a 0d 0a|"; reference:md5,64482895a11d120a9f17ded96aa43cd3; reference:md5,a108ae58850e8f48428070d3193e5c11; classtype:pup-activity; sid:2020422; rev:17; metadata:created_at 2015_02_13, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_02;)