Fake IT Support Page Delivering Remote Tool

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.