JavaScript Obfuscation Detection

Hunt Hypothesis

This hunt hypothesis targets adversaries who employ complex JavaScript obfuscation techniques within web applications or browser environments to conceal malicious payloads and evade signature-based security controls. A SOC team should proactively hunt for this behavior in Azure Sentinel because obfuscated scripts often serve as the initial entry point for fileless attacks, allowing attackers to execute stealthy commands that traditional static analysis might overlook.

YARA Rule

rule generic_javascript_obfuscation
{
meta:
	author = "Josh Berry"
	date = "2016-06-26"
	description = "JavaScript Obfuscation Detection"
	sample_filetype = "js-html"
strings:
	$string0 = /eval\(([\s]+)?(unescape|atob)\(/ nocase
	$string1 = /var([\s]+)?([a-zA-Z_$])+([a-zA-Z0-9_$]+)?([\s]+)?=([\s]+)?\[([\s]+)?\"\\x[0-9a-fA-F]+/ nocase
	$string2 = /var([\s]+)?([a-zA-Z_$])+([a-zA-Z0-9_$]+)?([\s]+)?=([\s]+)?eval;/
condition:
	any of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 3 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are specific false positive scenarios for the JavaScript Obfuscation Detection rule, including suggested filters and exclusions:

• Scenario 1: Automated Reporting Dashboard Refresh

  • Context: Enterprise BI platforms like Tableau, Power BI, or custom internal dashboards often load complex, minified JavaScript libraries to render real-time charts and interactive widgets. These scripts frequently utilize obfuscation techniques (variable renaming, control flow flattening) to optimize performance and protect proprietary logic during scheduled morning refreshes.
  • Suggested Filter/Exclusion: Create an exclusion for the specific service account or host running the BI server (e.g., ServiceAccount_BI on Host-Tableau01). Additionally, filter out alerts where the process image path contains known vendor directories such as \Program Files\Microsoft Power BI Desktop\ or \Program Files\Tableau\.

• Scenario 2: Software Deployment via Configuration Management

  • Context: During nightly patch cycles, tools like Ansible, Puppet, or SCCM (System Center Configuration Manager) execute JavaScript-based deployment agents. These agents often contain obfuscated scripts to handle complex logic for software installation, registry modification, and dependency checking without exposing internal configuration details to the network.
  • Suggested Filter/Exclusion: Exclude alerts originating from known deployment service accounts (e.g., svc_sccm_agent) running on the Configuration Management server. Implement a filter that suppresses detections if the parent process is identified as wuauserv.exe (Windows Update) or ccmexec.exe (SCCM Agent).

• Scenario 3: Modern Web Application Development Environments

  • Context: Internal development teams using Node.js with frameworks like React or Vue.js often build production-ready applications where the build process (using tools like **Webpack