SID 1:15362

Rule Category

INDICATOR-OBFUSCATION -- Snort detected a system behavior that suggests the system has been affected by malware. That behavior is known as an Indicator of Compromise (IOC). The symptoms could be a wide range of behaviors, from a suspicious file name to an unusual use of a utility. Symptoms do not guarantee an infection; your network configuration may not be affected by malware, but showing indicators as a result of a normal function. This alert specifically refers to a method of disguising code, known as obfuscation. Obfuscation methods are used to perform innocent convenience tasks (for instance, Javascript used to condense Jquery scripts, or a compiler using obfuscation to protect the full code for NDA reasons), or it could be used to hide an attack.

Alert Message

INDICATOR-OBFUSCATION obfuscated javascript excessive fromCharCode - potential attack

Rule Explanation

This event is generated when excessive use of the JavaScript method to convert CharCode to ASCII text, which can indicate an attempt to obfuscate malicious code. Impact: Misc activity Details: This rule catches attempts to evade IPS detection by using obfuscated text rather that typical ASCII text seen in HTML responses. Ease of Attack: Simple.

What To Look For

This rule looks for excessive use of specific Javascript methods which can indicate an attempt to circumvent defense systems such as IDS/IPS or AV

Known Usage

Attacks/Scans seen in the wild

False Positives

Known false positives, with the described conditions

In the modern web a sizeable amount of Javascript code is obfuscated in order to keep it moderately "secret". This is a practice that should be discouraged because it makes it harder to distinguish this code from malicious code trying to avoid inspection.

Contributors

Cisco Talos Intelligence Group