De-obfuscation method based on Powershell script

Abstract

The invention provides a de-obfuscation method based on the Powershell script. The method ecomprises the following steps: preprocessing a document, providing a virtual environment for automatic operation of an Office document, and minimizing macro safety; extracting the Powershell code from the code obfuscated in the document by using a Hook mechanism; and obtaining the original Powershell according to the obfuscation characteristics of the malicious Powershell in the document. The method has the beneficial effects that the Powershell embedded in the malicious document can be efficiently and quickly extracted, the original Powershell script is obtained, further deep analysis of safety personnel is facilitated, and a certain contribution is made to traceability evidence obtaining of attacks.

Description

technical field [0001] The invention relates to the field of security technology, in particular to a Powershell script-based de-obfuscation method. Background technique [0002] Due to the rapid development of anti-virus technology, the distribution of executable malicious programs has become more and more difficult, and attackers are increasingly inclined to use tools already present on the target computer to carry out malicious actions, which will leave fewer traces of the attack , making detection more difficult. Since Microsoft Powershell is installed by default on Windows systems, Powershell has become an ideal tool in the attack chain of many attack groups. Malicious Powershell scripts usually play the role of downloaders, and the most common form of use is to bundle Office macros for intrusion [1]. Such as figure 1 As shown, attackers usually trick users into opening Office documents (Word, Excel) through social engineering camouflage methods, and guide users to en...

AI Technical Summary

Problems solved by technology

[0008] The main shortcomings of the current research methods are: (1) Using the detection of Office macros to replace the detection of malicious Powershell has a very high false positive rate, and normal documents will also use Shell commands to call system functions; (2) Currently, for The extraction of malicious Powershell scripts is still manual analysis. As the number of samples using malicious Powershell increases, the obfuscation methods become more and more complicated. Manual analysis alone cannot meet the requirements; (3) For the obfuscation embedded in documents The Powershell script cannot automatically obtain the original Powershell for in-depth analysis

Images