alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET HUNTING Javascript Obfuscator Charcode+Hex Encoded Function Name"; flow:established,to_client; http.response_body; content:"fromCharCode|28|102|2c|117|2c|110|2c|99|2c|116|2c|105|2c|111|2c|110|2c|32|2c|95|2c|48|2c|120|2c|"; threshold:type limit,count 1,seconds 300,track by_src; classtype:bad-unknown; sid:2069970; rev:1; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_16, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_06_16, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise; target:dest_ip;)