alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP PUP Win32.SoftPulse Retrieving data"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/maxpower-static/templates/"; startswith; http.header_names; to_lowercase; content:!"|0d 0a|referer|0d 0a|"; reference:md5,4aa02ca6a3f04cf445924a6d657d10e5; classtype:pup-activity; sid:2019143; rev:9; metadata:created_at 2014_07_22, signature_severity Minor, updated_at 2024_05_01;)