Injected Malicious Content in Legitimate HTTP Response
This rule detects the presence of the string 'document.write(unescape(' in HTTP response bodies. This pattern is commonly used in web-based attacks to inject malicious content, often obfuscated, into legitimate web pages served to clients. The 'flow:to_client,established' indicates that the rule is looking at traffic flowing from the server to the client over an established connection, specifically within the HTTP data payload ('file.data'). The 'nocase' option ensures the detection is case-insensitive.
Suricata
