HTTP Response Content Injection via Proxy Logs (T1659)

Ankit Mehta@Secvyn

•updated Jun 26, 2026•1•0•7

This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().