alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopTools PUP Install Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_install.cgi"; http.user_agent; content:"BIDUI18N"; bsize:8; http.request_body; content:"name=|22|ufile01|22 3b 20|filename=|22|boundary|22|"; fast_pattern; content:"Content-Type|3a 20|application/octet-stream"; distance:0; http.header_names; content:!"Accept-"; content:!"Referer|0d 0a|"; reference:md5,3e464cff8690c7a2f57542688a278c62; classtype:pup-activity; sid:2022829; rev:4; metadata:created_at 2016_05_19, signature_severity Minor, updated_at 2020_08_31;)