WebGL and Browser Fingerprint Cloaking Script Detection

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

This rule detects suspicious JavaScript or HTML files that attempt to cloak browser fingerprints by manipulating WebGL renderer information, timezone settings, touch support, and tampering with the browser console or developer tools. It specifically looks for the co-occurrence of keywords related to these techniques within file names or the effective username associated with the file event.