In one embodiment, script patterns for identifying particular network viruses are written using a scripting language. The scripting language may allow for flow control, arithmetic, memory manipulation, and content matching operations, for example. Each script pattern may identify a particular network virus using a set of instructions supported by the scripting language. Among other advantages, the use of script patterns allows antivirus analysts to develop more flexible and effective patterns for dealing with current and future network threats.