ET EXPLOIT_KIT tdsshop Inject Script M2

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET EXPLOIT_KIT tdsshop Inject Script M2";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    http.response_body;
    content:"/i.test(navigator.userAgent)";
    content:"document|2e|currentScript|2e|src|2e|split|28 22 3f 22 29 5b|0|5d 2e|replace|28 2f 5c 2f|t|5c 2e|js|24 2f 2c 20 22 22 29 3b|"; fast_pattern; distance:0;
    content:"window.__analyticsUrl"; distance:0;
    content:"window.__analyticsSite"; distance:0;
    content:"/ext-b."; distance:0;
    content:"/ext."; distance:0;
    reference:url,silentpush.com/blog/drivesurge/;
    classtype:exploit-kit;
    sid:2069948; rev:1;
    metadata:attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_15, deployment Perimeter, deployment SSLDecrypt, confidence Medium, signature_severity Critical, tag Exploit_Kit, tag TDS, tag compromised_website, tag tdsshop, updated_at 2026_06_15, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;
    target:src_ip;
)