Fake IT Helpdesk Page Hosting Remote Tool
This rule detects HTTP traffic that appears to be a fake IT helpdesk page attempting to host a remote tool. It looks for the keywords "helpdesk", "download", and "remote" (case-insensitive) within the file data of HTTP responses. This combination of keywords suggests a social engineering attempt to trick users into downloading and executing remote access software under the guise of IT support.
Suricata
