SOCIAL-ENGINEERING - ClickFix Fake CAPTCHA Payload Delivery
Detects web traffic containing indicators of 'ClickFix' social engineering attacks. These attacks present a fake 'CAPTCHA' or verification prompt to the user and instruct them to copy and paste a malicious script (involving PowerShell or mshta) into their system terminal.
Suricata

