Fake Login Page for Credential Phishing
This rule detects potential credential phishing attempts by identifying HTTP responses (flow:to_client,established) that contain common keywords associated with login pages, specifically 'password', 'username', and 'action='. The rule looks for these keywords within the file data of the HTTP response, indicating a web page being served to the client that mimics a login form.
Suricata
