alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET INFO Observed Javascript for User Fingerprinting"; flow:established,to_client; http.stat_code; content:"200"; http.content_len; byte_test:0,<=,5000,0,string,dec; http.response_body; content:"(function("; distance:0; content:"|22|data|2d|u|22|"; distance:0; content:"|22|data|2d|p|22|"; distance:0; content:".screen"; distance:0; content:".document"; distance:0; content:"WEBGL_debug_renderer_info"; distance:0; content:"|22|stun:stun.l.google.com:19302|22|"; distance:0; content:"|22|POST|22|"; distance:0; content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0; content:"|2e|name|20 3d 20 22|analytics|22|"; distance:0; content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0; content:"|2e|name|20 3d 20 22 5f|h|22|"; distance:0; content:".value = hash"; distance:0; content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0; content:"|2e|name|20 3d 20 22 5f|p|22|"; fast_pattern; distance:0; content:"})(window, document)|3b|"; distance:0; classtype:misc-activity; sid:2069640; rev:1; metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_03, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_06_03;)