Possible XSS Token/Cookie Exfil Callback to External Listener

Arnold Chan@slaz

•updated Sep 12, 2026•1•0•4

Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.