alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/SmartTab PUP Install Activity 2"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/v"; startswith; content:".asp"; pcre:"/\/v\d\/[^.]+\.asp$/i"; http.user_agent; bsize:38; content:"Mozilla/3.0 (compatible|3b 20|Indy Library)"; fast_pattern; reference:md5,84fcdf1cd6dc3ee71686835f9489752c; classtype:pup-activity; sid:2022694; rev:6; metadata:created_at 2016_04_01, confidence High, signature_severity Minor, updated_at 2024_04_14;)