Exploring the Use of Machine Learning to Identify Threats in Powershell Scripts

PowerShell is a widely utilized tool by both system administrators and attackers for performing complex management tasks and launching attacks. The detection of malicious scripts poses a significant cybersecurity challenge due to the use of various obfuscations and the intricacy of analyses. This paper aims to provide a comprehensive overview of state-of-the-art techniques for detecting malicious PowerShell scripts using machine learning. It also discusses the potential integration of these techniques into SIEM (Security information and event management) systems to enhance threat detection. The final section of the paper puts forward a novel approach based on deep neural networks that utilizes a recurrent network architecture with deployed layers. Experimental results demonstrate the efficacy of the proposed model in accurately and reliably classifying obfuscated and complex scripts.