1. A computer-implemented method comprising: receiving a plurality of script code samples; transforming the plurality of script code samples into a plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying one or more similarities between at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples; based at least in part on the one or more similarities, identifying a cluster of samples including at least the first tokenized sample and the second tokenized sample; selecting the first tokenized sample as a representative sample of the cluster of samples; identifying known malicious code having a threshold similarity to the representative sample by de-obfuscating the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparing the de-obfuscated representative sample to a plurality of known malicious code samples; based on the identified known malicious code, labeling each of the samples in the cluster of samples as malicious, wherein the label of each of the samples in the cluster of samples as malicious is unscored; and generating, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature, wherein the generalized code signature identifies the first tokenized sample and the second tokenized sample.
1. A computer-implemented method comprising: receiving a plurality of script code samples; transforming the plurality of script code samples into a plurality of tokenized samples, the transforming based on syntactical elements of the plurality of script code samples; identifying one or more similarities between at least a first tokenized sample of the plurality of tokenized samples and a second tokenized sample of the plurality of tokenized samples; based at least in part on the one or more similarities, identifying a cluster of samples including at least the first tokenized sample and the second tokenized sample; selecting the first tokenized sample as a representative sample of the cluster of samples; identifying known malicious code having a threshold similarity to the representative sample by de-obfuscating the representative sample of the cluster of samples to produce a de-obfuscated representative sample and comparing the de-obfuscated representative sample to a plurality of known malicious code samples; based on the identified known malicious code, labeling each of the samples in the cluster of samples as malicious, wherein the label of each of the samples in the cluster of samples as malicious is unscored; and generating, based at least on the unscored labeled samples in the cluster of samples, a generalized code signature, wherein the generalized code signature identifies the first tokenized sample and the second tokenized sample. 7. The computer-implemented method of claim 1 , wherein the generating the generalized code signature includes: identifying a common subsequence of tokens shared by ones of the plurality of tokenized samples that correspond to each of the code samples in the cluster of samples that is labeled malicious; generating an expression usable to match code portions from respective ones of the code samples in the cluster of samples, the code portions corresponding to the common subsequence of tokens; and including the expression in the generalized code signature.