Attacker Impersonating IT Support via Web Page

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.