Detecting Malicious PowerShell Commands using Deep Neural Networks

Understand

Microsoft's PowerShell is a command-line shell and scripting language that is installed by default on Windows machines.

• While PowerShell can be configured by administrators for restricting access and reducing vulnerabilities, these restrictions can be bypassed.
• Moreover, PowerShell commands can be easily generated dynamically, executed from memory, encoded and obfuscated, thus making the logging and forensic analysis of code executed by PowerShell challenging.For all these reasons, PowerShell is increasingly used by cybercriminals as part of their attacks' tool chain, mainly for downloading malicious contents and for lateral movement.
• Indeed, a recent comprehensive technical report by Symantec dedicated to PowerShell's abuse by cybercrimials reported on a sharp increase in the number of malicious PowerShell samples they received and in the number of penetration tools and frameworks that use PowerShell.