Revoke Obfuscation: PowerShell Obfuscation
Framework using statistical analysis to detect and defeat PowerShell obfuscation and evasion techniques.
Summary
PowerShell in Attacks
Attackers, administrators, and legitimate products rely on PowerShell. Its power has made it attractive for attackers and commodity malware. The challenge is separating legitimate use from malicious activity.
Detection Challenges
A/V signatures applied to command line arguments work sometimes. AMSI-based detection performs better. However, obfuscation and evasion techniques like Invoke-Obfuscation can bypass both approaches.
Revoke-Obfuscation Framework
The framework transforms evasion into detection through unique statistical analysis techniques. It examines PowerShell scripts and structures to turn obfuscation into a spotlight. The framework works with .evtx files, command lines, scripts, ScriptBlock logs, and Module logs.
Operational Use
Revoke-Obfuscation has been used in numerous Mandiant investigations to identify obfuscated and non-obfuscated malicious PowerShell. It detects all obfuscation techniques in Invoke-Obfuscation, including two new techniques released with this presentation.
Related talks
Black Hat·57 min
Security researchers examine technical aspects of Revoke-Obfuscation: PowerShell Obfuscation Detection (And Evasion) Using Science.
nullcon·55 min
Engineers explore architecture and security mechanisms for 2017 - Invoke Obfuscation: Powershell Obfuscation Techniques n How To Try To Detect Them.
NahamSec·21 min
PowerShell Obfuscation
This Is How Hackers Evade Detection with PowerShell Obfuscation.