ET ADWARE_PUP Miuref/Boaxxe Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET ADWARE_PUP Miuref/Boaxxe Checkin";
    flow:to_server,established;
    urilen:>400;
    http.method;
    content:"GET";
    http.uri.raw;
    content:"%2b"; fast_pattern;
    content:"%2f";
    content:!"|2e|";
    content:!"|3f|";
    content:!"|26|";
    pcre:"/^\/(?:[a-zA-Z0-9]|%2[fb]){400,}$/";
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,welivesecurity.com/2014/01/17/boaxxe-adware-a-good-advert-sells-the-product-without-drawing-attention-to-itself-part-2/;
    reference:url,blogs.technet.com/b/mmpc/archive/2014/05/13/msrt-may-2014-miuref.aspx;
    classtype:pup-activity;
    sid:2018582; rev:12;
    metadata:created_at 2013_11_22, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_24;
)