Obfuscated VBScript Download

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•3

This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.