IMShell-Dec: Pay More Attention to External Links in PowerShell

Abstract

Windows proposes the PowerShell shell command line to substitute the traditional CMD. However, it is often utilized by the attacker to invade the victim because of its versatile functionality. In this paper, we investigate an attack combined PowerShell and image steganography. Compared with the traditional method, this attack can deceive the defender by hiding its malicious contents in benign images. To effectively detect this attack, we propose a framework IMShell-Dec, whose main target is to check external links before the execution of PowerShell script. IMShell-Dec trains a machine learning classifier with image examples, where the features are generated by merging histograms of three image color channels. Then IMShell-Dec examines the script through tracking and classifying the related images. The detector achieves more than 95% precision in 9,589 high-definition images.

Never Mind the Malware, Here’s the Stegomalware

“…In recent years, Invoke-PSImage has been exploited by Powload (spotted in the first half of 2018), and it is still in the toolbox of different incarnations of Emotet and Bebloh. 9,10 It is also the basis of stages for dropping payloads on the host of the victim in malicious software like the Greystar ransomware and some variants of Ursnif. 11 Another notable utilization concerns the creation of backdoors, as it happens in Bandook.…”

“…13 For the case of threats targeting images, some ad-hoc products are becoming available, e.g., the Steganography Defensive Initiative of McAfee, 14 but they do not appear mature enough for large-scale utilization. 10 The researchers and security experts genuinely concerned with stegomalware should then consider the following four principles when engineering defensive strategies.…”