HTTP Response Content Injection via MitM

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects HTTP response content injection via a Man-in-the-Middle (MitM) attack. It specifically looks for HTML content (indicated by 'Content-Type: text/html') in the HTTP response that contains a '<script' tag and a 'src' attribute pointing to an IP address (e.g., 'src="https?://[0-9]{1,3}\.[0-9]{1,3}'). This pattern suggests that an attacker might be injecting malicious scripts into legitimate web traffic.