ET ADWARE_PUP SoundCloud Downloader Install Beacon

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET ADWARE_PUP SoundCloud Downloader Install Beacon";
    flow:established,to_server;
    urilen:10;
    http.method;
    content:"POST";
    http.uri;
    content:"/index.php";
    http.request_body;
    content:"&OSversion=";
    content:"&Slv=";
    content:"&Sysid=";
    content:"&Sysid1=";
    content:"&admin=";
    content:"&browser=";
    content:"&exe=";
    content:"&ffver=";
    content:"&lang_DfltUser=";
    content:"&ver=";
    content:"&ts=";
    reference:url,blog.malwarebytes.org/online-security/2014/03/soundcloud-downloader-always-read-the-eulas/;
    reference:md5,2e20e446943ecd01d3a668083d81d1fc;
    classtype:pup-activity;
    sid:2018324; rev:4;
    metadata:attack_target Client_Endpoint, created_at 2014_03_26, deployment Perimeter, signature_severity Minor, tag c2, updated_at 2020_08_31, mitre_tactic_id TA0010, mitre_tactic_name Exfiltration, mitre_technique_id T1041, mitre_technique_name Exfiltration_Over_C2_Channel;
)