ET HUNTING Javascript Obfuscator Charcode+Hex Encoded Function Name

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET HUNTING Javascript Obfuscator Charcode+Hex Encoded Function Name";
    flow:established,to_client;
    http.response_body;
    content:"fromCharCode|28|102|2c|117|2c|110|2c|99|2c|116|2c|105|2c|111|2c|110|2c|32|2c|95|2c|48|2c|120|2c|";
    threshold:type limit,count 1,seconds 300,track by_src;
    classtype:bad-unknown;
    sid:2069970; rev:1;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_06_16, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_06_16, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1189, mitre_technique_name Drive_by_Compromise;
    target:dest_ip;
)