alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET HUNTING Fake Github .com Html Footer";
flow:established,to_client;
http.response_body;
content:"|3c|a|20|href|3d 22|https|3a 2f 2f|docs|2e|github|2e|com|2f|en|22 3e|Help|3c 2f|a|3e|"; fast_pattern;
content:"|3c|a|20|href|3d 22|https|3a 2f 2f|support|2e|github|2e|com|2f|contact|22 3e|Contact|3c 2f|a|3e|";
content:"|3c|a|20|href|3d 22|https|3a 2f 2f|docs|2e|github|2e|com|2f|en|2f|site|2d|policy|2f|privacy|2d|policies|2f|github|2d|cookies|22 3e|Manage|20|cookies|3c 2f|a|3e|";
reference:url,securitylabs.datadoghq.com/articles/tech-impersonators-clickfix-and-macos-infostealers/;
reference:url,x.com/suyog41/status/2019657315486712009;
classtype:misc-activity;
sid:2067664; rev:1;
metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_02_13, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Informational, updated_at 2026_02_13;
target:dest_ip;
)