Potential Cross-Site Scripting (XSS) Attempt

Ankit Mehta@Secvyn

•updated Jun 13, 2026•0•0•4

This rule detects potential Cross-Site Scripting (XSS) attempts by identifying multiple URI queries containing common XSS payloads such as '<script>', 'javascript:', or 'onerror=' within a one-hour window from the same client IP address. A count of 3 or more attempts triggers the alert.