ET HUNTING Javascript Redirect to Google .com

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET HUNTING Javascript Redirect to Google .com";
    flow:established,to_client;
    http.response_body;
    content:"window|2e|location|2e|replace|28 22|https|3a 5c 2f 5c 2f|www|2e|google|2e|com|5c 2f|";
    threshold:type limit,count 1,seconds 300,track by_src;
    classtype:misc-activity;
    sid:2072387; rev:1;
    metadata:affected_product Web_Browsers, attack_target Client_Endpoint, tls_state TLSDecrypt, created_at 2026_10_07, deployment Perimeter, deployment SSLDecrypt, confidence High, signature_severity Informational, updated_at 2026_10_07;
    target:dest_ip;
)