Imagen de Portada

MPSD: A Robust Defense Mechanism against Malicious PowerShell Scripts in Windows Systems

Guardado en:
Publicado en:Electronics vol. 13, no. 18 (2024), p. 3717
Autor principal: Min-Hao, Wu
Otros Autores: Fu-Hau Hsu, Jian-Hong Hunag, Wang, Keyuan, Yen-Yu, Liu, Chen, Jian-Xin, Wang, Hao-Jyun, Hao-Tsung, Yang
Publicado:
MDPI AG
Materias:
Red Canary
Scripts
Machine learning
Threats
Malware
Cybersecurity
Defense mechanisms
Threat evaluation
Natural language processing
Engines
Real time
Anti-virus software
Robustness
Acceso en línea:Citation/Abstract
Full Text + Graphics
Full Text - PDF
Etiquetas: Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
Resumen:This manuscript introduces MPSD (Malicious PowerShell Script Detector), an advanced tool to protect Windows systems from malicious PowerShell commands and scripts commonly used in fileless malware attacks. These scripts are often hidden in Office document macros or downloaded remotely via PowerShell, posing significant threats to corporate networks. A 2018 report revealed that 77% of successful cyberattacks involved fileless malware, with PowerShell being the primary attack method, as highlighted in Red Canary’s 2022 report. To counter these threats, MPSD leverages the Antimalware Scan Interface (AMSI) to intercept and analyze real-time PowerShell scripts, preventing their execution. It further utilizes VirusTotal to filter out malicious scripts. Unlike traditional methods that rely on direct access to scripts, MPSD detects them before execution, addressing the challenge of hidden or obfuscated scripts. Experimental results show that MPSD outperforms well-known antivirus engines, with a low false-negative rate of 1.83%. MPSD is highly effective against evasion techniques like concatenation, encoding, and reordering, making it a robust tool in the cybersecurity landscape.
ISSN:2079-9292
DOI:10.3390/electronics13183717
Fuente:Advanced Technologies & Aerospace Database