// MakeNotWork - embedded script downloaders / stagers.
// Conservative: a binary/asset that bundles a remote-fetch-and-execute stager
// is highly suspicious for a creative-content marketplace. Multi-token
// conditions keep false positives off legitimate code samples.

rule suspicious_script_in_binary {
    meta:
        description = "Executable/asset containing embedded script downloaders"
    strings:
        $ps1 = "powershell" ascii nocase
        $ps2 = "Invoke-Expression" ascii nocase
        $ps3 = "DownloadString" ascii nocase
        $bash1 = "curl " ascii
        $bash2 = "| bash" ascii
        $bash3 = "| sh" ascii
        $wget1 = "wget " ascii
    condition:
        (2 of ($ps*)) or (($bash1 or $wget1) and ($bash2 or $bash3))
}