alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/InstallCore Initial Install Activity 1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?v="; depth:4; content:"&subver="; fast_pattern; distance:0; content:"&pcrc="; distance:0; pcre:"/^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$/"; http.header_names; content:!"Accept-"; content:!"Referer"; reference:md5,0a6a0baf77b80706cab665754ecadac9; classtype:pup-activity; sid:2022807; rev:4; metadata:created_at 2016_05_16, signature_severity Minor, updated_at 2020_08_31;)