SID 1:29991

Rule Category

PUA-ADWARE -- Snort has detected a Potentially Unwanted Application (PUA). This Is a program which installs adware or toolbars, collects information, runs unwanted processes that consume computing resources, or has otherwise unclear objectives. These are usually additional programs bundled with legitimate programs. Some users consider the benefit of the main application to outweigh the risks of the PUA; you are paying for a free product by contributing with advertising or data. These alerts are often assigned a lower risk, as they are not directly malicious or as fast-spreading as worms or trojans. This alert concerns a PUA dealing with adware or spyware. This application might be trying to monitor your computer to relay user names and passwords, account numbers, or other sensitive data to a third party. This is not application-specific and is a more dangerous type of PUA.

Alert Message

PUA-ADWARE The Best All Codecs App runtime detection

Rule Explanation

This event is generated when a potentially unwanted application that is part of the Wajam family makes an outbound HTTP POST request to an external host. Impact: A potentially unwanted application was detected making an output HTTP POST request. Details: The rule detects outbound HTTP POST requests where the URI matches a specific pattern know to be associated with the Wajam family. Additionally, it check to see if the content of the outbound POST request matches known traffic patterns of the Wajam family. Ease of Attack:

What To Look For

No information provided

Known Usage

No public information

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group