Extracting Embedded Scripts from Command Line Interpreters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern antivirus systems face difficulties in detecting script-based malware, as scripts executed by trusted interpreters like cmd or PowerShell are often invisible in process views and can be easily embedded into webpages, emails, and documents, making it hard for existing methods to detect script files passed to interpreters.
Innovation Solution
A method and system that extracts embedded scripts from command line parameters or documents, saves them to a script file, and passes the file path to security components like scanners, whitelists, or sandboxes for scanning, allowing for the detection and analysis of script texts passed to interpreters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If antivirus products use traditional file-based detection methods, then they can detect script files passed to interpreters using file path or name, but they cannot detect script texts passed directly as parameters to interpreters
Solution Approach 1:
The patent extracts script text from command line parameters by identifying and separating the script portion from the interpreter command. The system parses the command line to extract the script text that follows the interpreter executable, then processes this extracted text through security scanning components, thereby detecting previously undetectable fileless scripts.
2Object-affected harmful factors
If scripts are executed by trusted interpreters like cmd or PowerShell, then the interpreters make scripts invisible in process view, but this also makes it easier for scripts to be embedded into webpages, emails, and documents
Solution Approach 1:
The patent implements preliminary detection by intercepting and analyzing command line parameters before the interpreter executes the script. The system scans the command line for embedded script text, extracts it, and submits it to security components for analysis before execution occurs, thereby preventing malware intrusion proactively rather than reactively.
Solution Approach 2:
The patent introduces an intermediary detection layer between the command line input and the interpreter execution. This intermediary component parses command line parameters, extracts script text, and routes it to security scanning components, acting as a mediator that enables detection of fileless scripts without interfering with legitimate interpreter functionality.
3Object-affected harmful factors
If multiple pieces of scripts are executed in a single command, then the detection process becomes more complex, but the security risk increases
Solution Approach 1:
The patent segments multiple script texts within a single command line parameter into separate extractable units. The system identifies delimiters and boundaries between different script portions, extracts each script text individually, and processes them through the security scanning pipeline separately, thereby managing complexity while maintaining comprehensive detection.
Data Source
AI summary
There is provided a method to detect script texts passed to interpreter and send them to security components, such as a scanner, whitelist and sandbox. The method is accomplished by extracting embedded script from command line parameters or documents, saving it to a script file and passing the file path to security components for scanning and further processing.