ATT&CK T1105 - Script Download via HTTP (PS1/VBS)

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.