Encoding Obfuscation - HTML Event Handler XSS with Encoded Whitespace - ATR-2026-00489 (c732fcc6-8085-59ec-aba6-6689c39bd756)
Detects encoding-obfuscated XSS injection attempts using HTML event handlers (onmouseleave, onerror, etc.) and CSS expression() with javascript:alert payloads and backslash-hex encoded whitespace or control-character bytes. This rule focuses on the encoding-obfuscation aspect: attackers embed byte sequences like \x0B (vertical tab), \x11 (device control), \x20 (space), \xE2\x80\x89 (thin space) as encoded prefix characters within HTML attributes to evade naive WAF/filter detection while still injecting executable JavaScript. Note: The XSS payloads are identical to ATR-2026-00476 (web_injection family) — both rules catch the same payload family from different probe contexts.