Malicious JavaScript Obfuscation - JSFireTruck Pattern

Robert Fly@robertfly

•updated Jun 23, 2025•1•1•49

Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.