Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Practical Behavioral Profiling of Power Shell Scripts through Static Analysis (Part 1)

Summary: Unit 42's Palo Alto Networks blog series describes a Python-based static analysis approach to profiling PowerShell script behaviors, built after the author manually labeled thousands of benign and malicious scripts to establish a ground truth. The author notes that benign and malicious scripts frequently exhibit the same behaviors - downloader, sleeps, enumeration, one-liner - so behavior alone cannot determine intent, and he aims to score malicious scripts around a 6.0 threshold.

Key Takeaway: The author's own example is a script that downloads and executes another script, enumerates system information, uses compression and heavy Base64 - and is an animated ASCII Rick Roll meme, meaning your analysts' behavior-based rules will flag it as malware. With thousands of scripts to assess at any given time and dynamic analysis failing for a myriad of reasons, the scoring threshold is the only thing standing between triage and manual review.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related