VBScript Attachment Delivered via Email

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.