title: Snort Rule to Detect Single JS or VBS file in ZIP file
body: <p>How can I make use of Snort rule to find ZIP files being downloaded that contain only a <strong>single</strong> .js or .vbs file? </p>
  
  <p>Thought of using pcre -> <strong>^PK.+.(js|JS|Js|jS)</strong></p>
  
  <p><strong>Sample of traffic:<br></strong>
  HTTP/1.1 200 OK<br>
  Date: Wed, 19 Apr 2017 19:46:43 GMT<br>
  Server: Apache<br>
  X-Powered-By: PHP/5.3.29<br>
  Cache-Control: no-cache, no-store, max-age=0, must-revalidate<br>
  Expires: Tue, 08 Jan 1935 00:00:00 GMT<br>
  Pragma: no-cache<br>
  Content-Disposition: attachment; <br>filename="document__917_8324_94_Apr___19___2017_09__44___27.zip"
  Content-Transfer-Encoding: binary<br>
  Keep-Alive: timeout=5, max=100<br>
  Connection: Keep-Alive<br>
  Transfer-Encoding: chunked<br>
  Content-Type: application/octet-stream<br></p>
  
  <p>4295b<br>
  <strong>PK</strong>...........JV...M(...G..&lt;...<strong>document__59020_001366_8039__Apr___19___2017__09__44___27.js</strong>UT    .....X...Xux...............gs.L.-.~?..?P.(
  %R.&lt;..e...TH.@..n.......[.2..4.g.{..{....s...&amp;......2.w..V.;u.f.'.....3&lt;........m&lt;..>..8..Z.K6...k.....q.7...v4z........_.....)...w..Zosw......X.4..2."..z>..o.....Q6.G.A6.i.......Muz..T.}.kf..z.W..._O......J.#.;S.{....,..k...z...lu.Y;.J..^.......P=[..jg.m65..........SY.1..F..z{.L..,.L...~o.Me..V.....a}&lt;.N
  .....x....;..]..~T..n...G........z>..o.Y.........M...+.z...^.P_w.(...|.2.,.{.]...........W..;.......lL...Wv..p..r..1}.........]...r..Wwg.gYr....>.-..6.....:+.'..~.1...?.Nj'G_..........m...r...r..S.m.W.....&lt;......wE...f.E....a...M</p>