Hi, Friends!
Tria.ge allowed me to capture the install traffic from this PUP even though it employs some anti-analysis.
alert http $HOME_NET any -> $EXTERNAL_NET any \
(msg:"ET ADWARE_PUP PC App Store Client Installation in Progress"; \
http.method; bsize:3; content:"GET"; \
http.uri; \
content:"/pixel.gif?"; startswith; \
content:"evt|5f|src|3d|fa|5f|installer"; distance:0; fast_pattern; \
content:"evt|5f|action|3d|installing"; distance:0; \
http.host; bsize:11; content:"pcapp|2e|store"; \
http.user_agent; \
content:"NSIS|5f|Inetc|20 28|Mozilla|29|"; startswith; \
reference:url,tria.ge/250521-sekkxsyjz3/behavioral1; \
reference:md5,5a275498e42aa511bc9146b6ad44eba5; \
classtype:pup-activity; \
sid:7979; rev:1; \
metadata:affected_product Microsoft_Windows, \
attack_target Client_Endpoint, \
tls_state TLSDecrypt, \
created_at 2025_05_21, \
deployment Perimeter, deployment SSLDecrypt, \
confidence High, \
signature_severity Major, \
tag Adware, \
mitre_tactic_id TA0009, mitre_tactic_name Collection, \
mitre_technique_id T1005, mitre_technique_name Data_from_local_system;)