alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET PHISHING Client Cloaking Javascript Observed"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"|3c|html|3e 3c|head|3e 3c|script|20|src|3d 27|"; content:"Aes|2e|Ctr|2e|decrypt|28|"; nocase; fast_pattern; pcre:"/^(?:[^0-9][a-zA-Z0-9_$]{1,254}),\s*(?:[^0-9][a-zA-Z0-9_$]{1,254}),\s*256\)\x3b/Ri"; content:"document|2e|write|28|output|29|"; distance:0; reference:url,unit42.paloaltonetworks.com/javascript-based-phishing/; classtype:credential-theft; sid:2033947; rev:2; metadata:affected_product Web_Browsers, attack_target Client_Endpoint, created_at 2021_09_14, deployment Perimeter, performance_impact Low, confidence Medium, signature_severity Minor, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_05_03;)