1. A computer-implemented method comprising: receiving a plurality of script code samples; transforming the plurality of script code samples into a plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying one or more similarities between at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples; based at least in part on the one or more similarities, identifying a cluster of samples including at least the first tokenized sample and the second tokenized sample; selecting the first tokenized sample as a representative sample of the cluster of samples; identifying known malicious code having a threshold similarity to the representative sample by de-obfuscating the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparing the de-obfuscated representative sample to a plurality of known malicious code samples; based on the identified known malicious code, labeling each of the samples in the cluster of samples as malicious, wherein the label of each of the samples in the cluster of samples as malicious is unscored; and generating, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature, wherein the generalized code signature identifies the first tokenized sample and the second tokenized sample.