1. A computer-implemented method comprising: receiving a plurality of script code samples; transforming the plurality of script code samples into a plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying a cluster of samples based on similarities in different ones of the plurality of tokenized samples; identifying known malicious code having a threshold similarity to a representative sample of the cluster of samples; based on the identifying, labeling the cluster of samples as malicious; and generating, based at least on respective ones of the plurality of tokenized samples associated with the cluster of samples, a generalized code signature usable to identify the script code samples in the cluster of samples.