ET HUNTING HTML Embedded JavaScript Extraction via URL.createObjectURL

7.0.35.0SID: 2072453Rev: 1Enabled2 views
Sourceet/open
Fileemerging-hunting.rules
CreatedOctober 15, 2026
UpdatedOctober 15, 2026
Classificationunknown
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING HTML Embedded JavaScript Extraction via URL.createObjectURL"; flow:established,to_client; content:"document.getElementBy"; pcre:"/^[^\x29]*?\x29\x2etextContent/Rs"; content:"URL|2e|createObjectURL|28|"; fast_pattern; pcre:"/^\s*new\s*Blob\x28[^\x29]*?type\s*\x3a\s*\x22text\x2fjavascript\x22/Rs"; classtype:unknown; sid:2072453; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_10_15, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2026_10_15;)

Metadata

attack targetClient_Endpoint
tls stateTLSDecrypt
created at2026_10_15
deploymentPerimeter
performance impactLow
confidenceHigh
signature severityMajor
updated at2026_10_15

Comments (0)

Please sign in to leave a comment.
Sign in

No comments yet. Be the first to comment!