Malicious JavaScript File Download

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.