HTTP Response Data Manipulated via MitM Attack

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.