Visual Basic Script Download via HTTP
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
Suricata
