Ad Network Content Injection with Malicious Script

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects potential malicious script injection from ad networks. It looks for HTTP responses (flow:to_client) that contain common ad-related terms in the HTTP referer header (ad., ads., advert., banner.) and also contain JavaScript code obfuscation techniques like 'eval(' and 'fromCharCode' within the file data. This combination suggests an ad network might be serving malicious JavaScript to clients.