alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP DesktopTraffic Toolbar Spyware"; flow:established,to_server; http.uri; content:"cgi-bin/ezl_kws.fcgi?cat"; nocase; reference:url,research.spysweeper.com/threat_library/threat_details.php?threat=desktoptraffic.net_hijack; classtype:pup-activity; sid:2001884; rev:7; metadata:created_at 2010_07_30, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_15;)