SIG: ET HUNTING Possible JSFireTruck JavaScript Obfuscation

Rule Signatures
1

The rendered squares here are actually [ and ]

alert tcp $EXTERNAL_NET $HTTP_PORTS → $HOME_NET any (msg:“ET HUNTING Possible JSFireTruck JavaScript Obfuscation”; flow:established,to_client; file_data; content:“+”; content:“]+”; pcre:“/[+$!(){}0-9]{70,}/m”; classtype:bad-unknown; reference:url,JSFireTruck: Exploring Malicious JavaScript Using JSF*ck as an Obfuscation Technique; reference:url,GitHub - aemkei/jsfuck: Write any JavaScript with 6 Characters: []()!+; sid:156701; rev:1;)

Kind Regards,
Kevin Ross

2

Thanks, Kevin. I’ll look into this suggestion!

Cheers,
:hotdog:

3

Late update – this was a great share and two rules were created in June to alert on this activity.

2063161 - ET INFO Observed Usage of Non-Alphanumeric Javascript Obfuscation M2
2063156 - ET HUNTING Observed Usage of Non-Alphanumeric Javascript Obfuscation M1

Looking forward to the future shares, Kevin. Thanks again!

1 Like