alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/Toolbar.Conduit.AG Checkin"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.user_agent; bsize:20; content:"NSIS_Inetc (Mozilla)"; http.request_body; content:"postInstallReport"; fast_pattern; content:"machineId|22 3a 22|"; reference:md5,8fc00c6696268ae42411a5ebf9d2576f; classtype:pup-activity; sid:2021094; rev:7; metadata:created_at 2015_05_14, signature_severity Minor, updated_at 2024_03_27;)