alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Win32/InstallCore Initial Install Activity 1"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/?v="; startswith; content:"&subver="; fast_pattern; distance:0; content:"&pcrc="; distance:0; pcre:"/^\/\?v=[\d\.]{3,4}&subver=[\d\.]{4,5}&pcrc=\d+$/"; http.header_names; to_lowercase; content:!"|0d 0a|accept-"; content:!"|0d 0a|referer|0d 0a|"; reference:md5,0a6a0baf77b80706cab665754ecadac9; classtype:pup-activity; sid:2022807; rev:6; metadata:created_at 2016_05_16, signature_severity Minor, updated_at 2024_05_01;)