SOHO Hijack - Cross-Site Scripting via Injected Ads (T1185)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•2•0•8

Detects browsers loading external anomalous scripts from known malvertising domains while visiting plaintext HTTP sites (Router injection). This rule specifically looks for network connections on port 80 (HTTP) that are joined with device network events where the remote URL matches a regex for known malvertising domains (.xyz, .top, .site) and ends with '.js', indicating an injected script.