alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Tech Support Phone Scam Landing 2023-04-17"; flow:established,to_client; http.stat_code; content:"401"; http.header; content:"WWW-Authenticate|3a 20|Basic realm=|22|"; nocase; content:"Call"; nocase; distance:0; content:"Security Helpline immediately."; nocase; distance:0; fast_pattern; reference:url,malwarebytes.com/blog/threat-intelligence/2023/04/massive-malvertising-campaign-targets-seniors-via-fake-weebly-sites; classtype:credential-theft; sid:2044972; rev:1; metadata:attack_target Client_Endpoint, created_at 2023_04_17, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_17;)