Banking Web Inject Form Overlay Detected

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.