Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Practical Behavioral Profiling of Power Shell Scripts through Static Analysis (Part 3)

Summary: Unit 42 published Part 3 of a series on static analysis of PowerShell scripts, releasing a Python tool called PowerShellProfiler.py that scores scripts against a malicious threshold of 6.0 based on detected behaviors. The author built a baseline from roughly 5,000 manually classified scripts - about 3,000 benign and 2,000 malicious - and reports an average processing time of around 2 milliseconds per script.

What you should know: At roughly 2 milliseconds per file, bulk scanning of hundreds of thousands of PowerShell scripts becomes practical, and the tool's behavior flags - Downloader, Enumeration, Persistence - point investigators to the domains, registry keys, and file paths worth hunting. The gap the author names is that static analysis only sees what the script contains, while ScriptBlock logging (event ID 4104) captures what PowerShell actually executed after de-obfuscation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related