Watering Hole Malicious Script Injection

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects potential watering hole attacks by identifying HTTP responses (flow to client) that contain a combination of HTML script tags, 'document.write', and 'eval(' within the file data. This pattern is indicative of malicious JavaScript injection designed to execute code on the client side.