alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP overtls.com adware request"; flow:established,to_server; http.uri; content:"/sidebar.asp?bn=0&qy="; http.header; content:"EmbeddedWB"; classtype:pup-activity; sid:2012693; rev:6; metadata:created_at 2011_04_19, signature_severity Minor, updated_at 2024_03_06;)