JavaScript Hex Encoded Payload Delivery

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•6

This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.