alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP MultiPlug.A checkin"; flow:established,to_server; http.uri; content:"get/?ver="; content:"&aid="; distance:0; content:"&hid="; distance:0; content:"&rid="; distance:0; content:"&data="; distance:0; content:"&report="; distance:0; pcre:"/^\/get\/\?ver=.+?\&aid=\d{8,12}\&hid=[a-f0-9]{15,17}&rid=\d{13}\&data=.*?&report=/"; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:md5,f9556acf36168414ad7d5650eeee7972; reference:md5,69e28b658520528a1473f51e62698c87; classtype:pup-activity; sid:2018867; rev:6; metadata:created_at 2014_08_01, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_28;)