ET MALWARE Lumma Stealer Related Fake Captcha Page Inbound M3

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE Lumma Stealer Related Fake Captcha Page Inbound M3";
    flow:established,to_client;
    http.response_body;
    content:"not|20|a|20|robot";
    content:"recaptcha-box";
    content:"textToCopy|20 3d 20|"; fast_pattern;
    pcre:"/^(\x22|\x60)/R";
    content:"powershell"; within:11; nocase;
    reference:url,x.com/kddx0178318/status/1846908706518155520;
    reference:url,urlscan.io/result/09e5b99e-b240-4780-bf2b-fd344bde4969;
    classtype:trojan-activity;
    sid:2056732; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_10_18, deployment Perimeter, deployment SSLDecrypt, malware_family lumma, confidence High, signature_severity Major, updated_at 2024_12_11, reviewed_at 2025_05_14;
)