HTTP: Hidden IFrame Injection Javascript

This signature detects Javascript attempting to inject a potentially hostile IFrame into a webpage. Such activity is extremely common for current drive-by infection websites. These kinds of attacks take normally safe and trusted websites and append malicious content to them, making them very difficult to detect. This particular technique is currently in use by the Blackhole botnet.

Short Name
HTTP:STC:HIDDEN-IFRAME-2
Severity
Critical
Recommended
False
Recommended Action
Drop
Category
HTTP
Keywords
Hidden IFrame Injection Javascript
Release Date
01/22/2013
Supported Platforms

srx-branch-12.3

srx-19.3

srx-branch-19.3

vsrx3bsd-19.2

srx-branch-19.4

vsrx-19.4

mx-12.3

mx-19.4

vmx-19.4

mx-19.3

vsrx3bsd-19.4

srx-19.4

vsrx-12.3

vmx-19.3

vsrx-19.2

srx-12.3

Sigpack Version
3375
False Positive
Unknown

Found a potential security threat?