XSL Transform with Embedded JScript Payload
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
Suricata
