ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin 4

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET ADWARE_PUP Win32/Adware.Adposhel.A Checkin 4";
    flow:established,to_server;
    http.request_body;
    content:"a="; depth:2;
    content:"&c="; distance:0;
    content:"&r="; distance:0;
    pcre:"/^a=[a-zA-Z0-9_-]+&c=[a-zA-Z0-9_-]+&h=[a-zA-Z0-9_-]+&r=[0-9]{15,}$/";
    http.request_line;
    content:"POST /u/"; depth:8; fast_pattern;
    http.connection;
    content:"Close"; nocase; depth:5; endswith;
    http.content_type;
    content:"application/x-www-form-urlencoded"; depth:33; endswith;
    http.header_names;
    content:!"Accept";
    content:!"Referer|0d 0a|"; nocase;
    reference:md5,3ea75d62966f8c52de16d7849eeb3691;
    classtype:pup-activity;
    sid:2022723; rev:5;
    metadata:created_at 2016_04_11, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_05;
)