ATT&CK T1190 - XSS Attempt Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects attempts to inject client-side scripts, commonly known as Cross-Site Scripting (XSS), by looking for the string "<script>" within the HTTP URI of network traffic. This is a common indicator of an attacker trying to execute malicious scripts in a user's browser.