alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP TopTools PUP Install Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"_install.cgi"; http.user_agent; bsize:8; content:"BIDUI18N"; http.request_body; content:"name=|22|ufile01|22 3b 20|filename=|22|boundary|22|"; fast_pattern; content:"Content-Type|3a 20|application/octet-stream"; distance:0; http.header_names; to_lowercase; content:!"|0d 0a|accept-"; content:!"|0d 0a|referer|0d 0a|"; reference:md5,3e464cff8690c7a2f57542688a278c62; classtype:pup-activity; sid:2022829; rev:6; metadata:created_at 2016_05_19, signature_severity Minor, updated_at 2024_04_29;)