alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Freeze.com Spyware/Adware (Install)"; flow:established,to_server; http.uri; content:"/checkhttp.htm"; nocase; http.header; content:"freeze.com"; nocase; http.user_agent; content:"Wise"; nocase; startswith; classtype:pup-activity; sid:2002840; rev:11; metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2024_04_13;)