Fake Security Alert Page Spoofing AV Vendor

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.