Abstract:Microsoft's PowerShell is a command-line shell and scripting language that is installed by default on Windows machines. Based on Microsoft's .NET framework, it includes an interface that allows programmers to access operating system services. While PowerShell can be configured by administrators for restricting access and reducing vulnerabilities, these restrictions can be bypassed. Moreover, PowerShell commands can be easily generated dynamically, executed from memory, encoded and obfuscated, thus making the logging and forensic analysis of code executed by PowerShell challenging. For all these reasons, PowerShell is increasingly used by cybercriminals as part of their attacks' tool chain, mainly for downloading malicious contents and for lateral movement. Indeed, a recent comprehensive technical report by Symantec dedicated to PowerShell's abuse by cybercrimials [52] reported on a sharp increase in the number of malicious PowerShell samples they received and in the number of penetration tools and frameworks that use PowerShell. This highlights the urgent need of developing effective methods for detecting malicious PowerShell commands. In this work, we address this challenge by implementing several novel detectors of malicious PowerShell commands and evaluating their performance. We implemented both "traditional" natural language processing (NLP) based detectors and detectors based on character-level convolutional neural networks (CNNs). Detectors' performance was evaluated using a large real-world dataset. Our evaluation results show that, although our detectors (and especially the traditional NLP-based ones) individually yield high performance, an ensemble detector that combines an NLP-based classifier with a CNN-based classifier provides the best performance, since the latter classifier is able to detect malicious commands that succeed in evading the former. Our analysis of these evasive commands reveals that some obfuscation patterns automatically detected by the CNN classifier are intrinsically difficult to detect using the NLP techniques we applied. Our detectors provide high recall values while maintaining a very low false positive rate, making us cautiously optimistic that they can be of practical value.

AST-Based Deep Learning for Detecting Malicious PowerShell

Detecting Malicious PowerShell Commands using Deep Neural Networks

AMSI-Based Detection of Malicious PowerShell Code Using Contextual Embeddings

Machine Learning Approaches to Malicious PowerShell Scripts Detection and Feature Combination Analysis

PowerDP: De-Obfuscating and Profiling Malicious PowerShell Commands With Multi-Label Classifiers

Effective and Light-Weight Deobfuscation and Semantic-Aware Attack Detection for PowerShell Scripts

A deep learning approach for detecting malicious JavaScript code

Generic, Efficient, and Effective Deobfuscation and Semantic-Aware Attack Detection for PowerShell Scripts

Malware Analysis Using Machine Learning and Deep Learning Techniques

SCORE: Syntactic Code Representations for Static Script Malware Detection

PowerPeeler: A Precise and General Dynamic Deobfuscation Method for PowerShell Scripts

A Hierarchical Deep Neural Network for Detecting Lines of Codes with Vulnerabilities

The Power of Words: Generating PowerShell Attacks from Natural Language

Invoke-Deobfuscation: AST-Based and Semantics-Preserving Deobfuscation for PowerShell Scripts

AST-DF: A New Webshell Detection Method Based on Abstract Syntax Tree and Deep Forest

Detection of Malicious Code Variants Based on Deep Learning

A Hybrid Deep Learning Model for Malicious Behavior Detection

GlareShell: Graph learning-based PHP webshell detection for web server of industrial internet

MPSD: A Robust Defense Mechanism against Malicious PowerShell Scripts in Windows Systems

A Deep Learning Approach to Fast, Format-Agnostic Detection of Malicious Web Content

EarlyMalDetect: A Novel Approach for Early Windows Malware Detection Based on Sequences of API Calls