ET INFO Observed Javascript for User Fingerprinting

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET INFO Observed Javascript for User Fingerprinting";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    http.content_len;
    byte_test:0,<=,5000,0,string,dec;
    http.response_body;
    content:"(function("; distance:0;
    content:"|22|data|2d|u|22|"; distance:0;
    content:"|22|data|2d|p|22|"; distance:0;
    content:".screen"; distance:0;
    content:".document"; distance:0;
    content:"WEBGL_debug_renderer_info"; distance:0;
    content:"|22|stun:stun.l.google.com:19302|22|"; distance:0;
    content:"|22|POST|22|"; distance:0;
    content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0;
    content:"|2e|name|20 3d 20 22|analytics|22|"; distance:0;
    content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0;
    content:"|2e|name|20 3d 20 22 5f|h|22|"; distance:0;
    content:".value = hash"; distance:0;
    content:"|2e|type|20 3d 20 22|hidden|22|"; distance:0;
    content:"|2e|name|20 3d 20 22 5f|p|22|"; fast_pattern; distance:0;
    content:"})(window, document)|3b|"; distance:0;
    classtype:misc-activity;
    sid:2069640; rev:1;
    metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_03, deployment Perimeter, confidence High, signature_severity Informational, updated_at 2026_06_03;
)