JavaScript Obfuscation in HTTP Response

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•1

This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.