PowerShell Script Detection via Text Pattern Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional antivirus and configuration management software are ineffective in detecting malicious PowerShell scripts, as they cannot scan non-compiled script files on remote systems for potentially malicious instructions before execution, and cannot determine whether the script code is benign or malicious.

Innovation Solution

A system and method where a security server scans file directories of remote devices to identify and analyze PowerShell scripts using a malicious-code dataset to determine if they contain malicious attributes, and upon detection, terminates the infected device's connection to the enterprise network.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional antivirus software scans hard drives for compiled executable files using malware signatures, then it can identify known viruses, but it cannot scan non-compiled script files like PowerShell scripts to detect potentially malicious instructions before execution

Engineering Contradiction:

Improvedetection capabilityVSAvoidcoverage of script file types

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent changes the detection parameter from binary signature matching to text-based pattern recognition. Instead of relying on compiled executable signatures, the system analyzes the text content of PowerShell scripts using regex patterns and code parsing to identify malicious instructions, enabling detection of uncompiled script files that traditional antivirus cannot analyze.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the mechanical signature-based scanning approach with a linguistic analysis approach. Rather than searching for binary malware signatures, the system uses text processing, regular expressions, and code parsing techniques to detect malicious patterns in PowerShell script text, substituting the mechanical scanning process with a more adaptable textual analysis mechanism.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If conventional antivirus software identifies PowerShell scripts during hard drive scan, then it can locate script files, but it cannot review the underlying content of the script code to determine whether the code is malicious or benign

Engineering Contradiction:

Improvescan speedVSAvoiddetection accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The patent segments the PowerShell script into parseable components using the PowerShell language parser. By breaking down the script into statements, commands, and code objects, the system can systematically analyze each segment for malicious patterns, enabling both speed and accuracy through structured analysis of individual code elements rather than monolithic scanning.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a PowerShell language parser as an intermediary between the raw script text and the detection analysis. This parser serves as a mediator that converts unstructured script text into parseable code objects, enabling the system to accurately interpret and analyze the semantic meaning of PowerShell commands to determine malignancy with high precision.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If PowerShell is installed and executed on many enterprise workstations for task automation, then it enables efficient task automation and device configuration management, but the frequency of PowerShell script execution instances complicates efforts in detecting malicious PowerShell scripts

Engineering Contradiction:

Improvetask automation efficiencyVSAvoiddetection complexity

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The patent implements preliminary action by scanning and analyzing PowerShell scripts before they are executed on enterprise workstations. The system proactively identifies and analyzes scripts in advance, creating a detection mechanism that operates independently of execution frequency, thereby maintaining detection capability regardless of how often PowerShell scripts are run across the enterprise.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent creates a copy of the PowerShell script for analysis purposes. By parsing and analyzing a copy of the script content rather than interfering with the actual execution process, the system can detect malicious patterns without affecting the productivity and task automation functionality of legitimate PowerShell scripts running on enterprise workstations.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS12174953B1Systems and methods of detecting malicious powershell scripts

Publication Date: 2024.12.24 UNITED SERVICES AUTOMOBILE ASSOCIATION (USAA)

AI summary

Disclosed herein are systems and methods of executing scanning software, such an executable software program or script (e.g., PowerShell script), by a computing device of an enterprise, such as a security server, may instruct the computing device to search all or a subset of computing devices in an enterprise network. The scanning software may identify PowerShell scripts containing particular malware attributes, according to a malicious-code dataset. The computing system executing the scanning software may scan through the identified PowerShell scripts to identify particular strings, values, or code-portions, and take a remedial action according to the scanning software programming.