ET RETIRED AlphabetSoup Adware Extension CnC Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET RETIRED AlphabetSoup Adware Extension CnC Checkin";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:"/installLog.php?scheme="; startswith;
    content:"cpuid=";
    content:"chromeLog=";
    content:"ffLog=";
    content:"operaLog=";
    content:"foundBefore=";
    content:"notAdmin=";
    content:"winVer=";
    content:"user=";
    content:"defBrowser="; fast_pattern;
    content:"uniID=";
    content:"partner=";
    content:"startid=";
    content:"execid=";
    content:"vbdg=";
    http.header_names;
    content:!"Referer";
    reference:url,blog.zimperium.com/abc-soup-the-malicious-adware-extension-with-350-variants;
    classtype:trojan-activity;
    sid:2037741; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_07_11, deployment Perimeter, deployment SSLDecrypt, former_category ADWARE_PUP, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_04_17, reviewed_at 2025_04_17;
)