XOR Decoding Routine in Downloaded Script

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.