Fake CAPTCHA Paste Attack Page Detected
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
Suricata
