Efficient Detection and Recovery of Malicious PowerShell Scripts Embedded into Digital Images. (29th June 2022)

• Record Type: Journal Article
• Authors: Schaffhauser, Andreas; Mazurczyk, Wojciech; Caviglione, Luca; Zuppelli, Marco; Hernandez-Castro, Julio
• Other Names: Conti Vincenzo Academic Editor.
• Is Part Of: Security and communication networks. Volume 2022(2022)
• Publication Date: 2022-06-29
• Subjects: Computer networks -- Security measures -- Periodicals; Computer security -- Periodicals; Cryptography -- Periodicals; 005.805
• DOI: 10.1155/2022/4477317
• Languages: English
• ISSNs: 1939-0114

Abstract

Abstract : Due to steady improvements in defensive systems, malware developers are turning their attention to mechanisms for cloaking attacks as long as possible. A recent trend exploits techniques like Invoke-PSImage, which allows embedding a malicious script within an innocent-looking image, for example, to smuggle data into compromised devices. To address such a class of emerging threats, new mechanisms are needed, since standard tools fail in their detection or offer poor performance. To this aim, this work introduces Mavis, an efficient and highly accurate method for detecting hidden payloads, retrieving the embedded information, and estimating its size. Experimental results collected by considering real-world malicious PowerShell scripts showcase that Mavis can detect attacks with a high accuracy (100%) while keeping the rate of false positives and false negatives very low (0.01% and 0%, respectively). The proposed approach outperforms other solutions available in the literature or commercially through "as a service" model.