https://live.paloaltonetworks.com/t5/advanced-threat-prevention/false-positive-generic-malicious-javascript-detection-86736/m-p/540262#M1928 <P>Since this new spyware signature was pushed Monday, we have seen a huge number of hits across major websites. Then this morning the signature was pulled as possibly having false positive detection problems. However, I have been investigating the hits in between and seen troubling indicators of suspicious behavior. Specifically, the alert is trigger on Javascript files included on websites that have all of the following characteristics:</P> <OL> <LI>Scripts included at the top of the head section of the page, instead of inline in the body</LI> <LI>Scripts with seemingly random generated names</LI> <LI>Scripts that are heavily obfuscated with function/variable name replacement with random strings or hexadecimal strings</LI> <LI>Scripts that change obfuscation and variable reordering every few minutes</LI> </OL> <P>All of these point to potentially malicious Javascript. Does anyone have any more information on these detections or what the original signature was trying to match?</P> Wed, 26 Apr 2023 23:18:41 GMT Adrian_Jensen 2023-04-26T23:18:41Z https://live.paloaltonetworks.com/t5/advanced-threat-prevention/false-positive-generic-malicious-javascript-detection-86736/m-p/540262#M1928 <P>Since this new spyware signature was pushed Monday, we have seen a huge number of hits across major websites. Then this morning the signature was pulled as possibly having false positive detection problems. However, I have been investigating the hits in between and seen troubling indicators of suspicious behavior. Specifically, the alert is trigger on Javascript files included on websites that have all of the following characteristics:</P> <OL> <LI>Scripts included at the top of the head section of the page, instead of inline in the body</LI> <LI>Scripts with seemingly random generated names</LI> <LI>Scripts that are heavily obfuscated with function/variable name replacement with random strings or hexadecimal strings</LI> <LI>Scripts that change obfuscation and variable reordering every few minutes</LI> </OL> <P>All of these point to potentially malicious Javascript. Does anyone have any more information on these detections or what the original signature was trying to match?</P> Wed, 26 Apr 2023 23:18:41 GMT https://live.paloaltonetworks.com/t5/advanced-threat-prevention/false-positive-generic-malicious-javascript-detection-86736/m-p/540262#M1928 Adrian_Jensen 2023-04-26T23:18:41Z