Search Result Content Injection Redirect
This rule detects HTTP responses from a web server to a client that contain JavaScript code attempting to redirect the user's browser. Specifically, it looks for the string "window.location.replace" within the HTTP response body (file.data) when the HTTP referer header indicates the request originated from Google or Bing search results. This pattern is often associated with content injection attacks where malicious code is injected into legitimate search results to redirect users to malicious sites.
Suricata
