alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Lavasoft PUA/Adware Client Install"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/event-stat?ProductID="; fast_pattern; content:"&Type=StubStart"; distance:0; http.host; content:"lavasoft.com"; classtype:pup-activity; sid:2025537; rev:3; metadata:attack_target Client_Endpoint, created_at 2018_04_26, deployment Perimeter, confidence High, signature_severity Minor, tag Adware, updated_at 2020_08_31;)