Malicious VBScript Macro Delivery in Office File

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.