alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET PHISHING Generic Credential Phish Landing Page with Explicit Cloudflare Turnstile Rendering 2024-11-07";
flow:established,to_client;
http.stat_code;
content:"200";
http.response_body;
content:"<head>";
content:"challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback"; distance:0;
content:"sendRequest()"; distance:0;
content:"String.fromCharCode"; distance:0;
content:"function sendRequest()"; distance:0;
content:"xhr|2e|setRequestHeader|28 22|qrc|2d|auth|22|"; distance:0; fast_pattern;
content:"</head>"; distance:0;
reference:url,developers.cloudflare.com/turnstile/get-started/client-side-rendering/#explicitly-render-the-turnstile-widget;
classtype:credential-theft;
sid:2057301; rev:1;
metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2024_11_07, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Major, tag Phishing, updated_at 2024_11_07, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1566, mitre_technique_name Phishing;
)