alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin 3"; flow:established,to_server; http.method; content:"HEAD"; http.uri; content:"/u/?"; depth:4; fast_pattern; content:"&c="; distance:0; content:"&r="; distance:0; pcre:"/^\/u\/\?[a-z]=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&r=[0-9]{17,}$/"; reference:url,blog.malwarebytes.org/cybercrime/2016/01/trojan-dnschanger-circumvents-powershell-restrictions/; classtype:pup-activity; sid:2022722; rev:4; metadata:created_at 2016_04_11, confidence High, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_08_31;)