alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET POLICY AskSearch? Toolbar Spyware User-Agent (AskTBar?) 2"; flow:to_server,established; content:"AskTb"; http_user_agent; depth:5; classtype:policy-violation; sid:2015757; rev:2; metadata:attack_target Client_Endpoint, deployment Perimeter, tag Spyware_User_Agent, signature_severity Minor, created_at 2012_10_04, updated_at 2016_07_01;)

Added 2017-08-07 21:09:23 UTC

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET POLICY AskSearch? Toolbar Spyware User-Agent (AskTBar?) 2"; flow:to_server,established; content:"User-Agent|3a| AskTb?"; http_header; classtype:policy-violation; sid:2015757; rev:1;)

Added 2012-10-03 23:17:17 UTC