1. At least one non-transitory machine accessible storage medium having instructions stored thereon for detecting malicious code in a script, wherein the instructions, when executed by at least one processor, cause the at least one processor to perform a method comprising: evaluating a left side variable name of an assignment statement in the script or a right side value of the assignment statement to produce a result indicating a compilation event; initiating, by an execution engine, an execution of a compiled script resulting from a compilation of the script; detecting a function called by the compiled script; executing the function and performing an evaluation of the function; detecting an execution event during the evaluation of the function, wherein the execution event is detected based on a parameter passed into the function, a result of the function, data written or replaced by the function, or data calculated by the function at least meeting or exceeding a predetermined threshold length or size; and verifying, against a correlation signature defining a combination of events that indicate the script is malicious, a time or a location in the script of an occurrence of the compilation event relative to the execution event.