ET ADWARE_PUP 2020search/PowerSearch Toolbar Adware/Spyware - GET

Query · suricata

flow:established,to_server;
http.method;
content:"GET"; nocase;
http.uri;
content:"IpAddr="; nocase;
content:"&OS="; nocase;
content:"&RegistryChanged="; nocase;
content:"&RegistryUpdate="; nocase;
content:"&NewInstallation="; nocase;
content:"&utilMissing="; nocase;
content:"&Basedir="; nocase;
content:"&BundleID="; nocase;
content:"&InitInstalled="; nocase;
content:"&Interval="; nocase;
content:"&LastInitRun="; nocase;
content:"&LastInitVer="; nocase;
content:"&LastSrngRun="; nocase;
content:"&LastUtilRun="; nocase;
content:"&SrngInstalled="; nocase;
content:"&SrngVer="; nocase;
content:"&UtilInstalled="; nocase;
content:"&UtilVer="; nocase;
content:"&PCID"; nocase;
Raw source ET ADWARE_PUP 2020search/PowerSearch Toolbar Adware/Spyware - GET · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET ADWARE_PUP 2020search/PowerSearch Toolbar Adware/Spyware - GET";
    flow:established,to_server;
    http.method;
    content:"GET"; nocase;
    http.uri;
    content:"IpAddr="; nocase;
    content:"&OS="; nocase;
    content:"&RegistryChanged="; nocase;
    content:"&RegistryUpdate="; nocase;
    content:"&NewInstallation="; nocase;
    content:"&utilMissing="; nocase;
    content:"&Basedir="; nocase;
    content:"&BundleID="; nocase;
    content:"&InitInstalled="; nocase;
    content:"&Interval="; nocase;
    content:"&LastInitRun="; nocase;
    content:"&LastInitVer="; nocase;
    content:"&LastSrngRun="; nocase;
    content:"&LastUtilRun="; nocase;
    content:"&SrngInstalled="; nocase;
    content:"&SrngVer="; nocase;
    content:"&UtilInstalled="; nocase;
    content:"&UtilVer="; nocase;
    content:"&PCID"; nocase;
    reference:url,vil.nai.com/vil/content/v_103738.htm;
    reference:url,www.sunbeltsecurity.com/ThreatDisplay.aspx?tid=13811&cs=1437A28B7A90C4C502B683CE6DE23C4E;
    reference:url,www.symantec.com/security_response/writeup.jsp?docid=2004-111918-0210-99;
    classtype:pup-activity;
    sid:2009807; rev:7;
    metadata:created_at 2010_07_30, signature_severity Minor, updated_at 2020_08_31;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.