Home Security Windows PowerShell threats on the rise: Symantec

Malicious scripts written using the Windows PowerShell framework are on the increase, Symantec has warned after a study by researchers found that 95% of analysed scripts fell into this category.

Threat researcher Candid Wueest said attackers were using the framework’s flexibility to download their payloads, move through a compromised network, and carry out reconnaissance.

Symantec analysed PowerShell malware samples to find out how much of a danger they posed.

Of all of the PowerShell scripts analysed through the BlueCoat Malware Analysis sandbox, 95.4% were malicious. "This shows that externally sourced PowerShell scripts are a major threat to enterprises," Wueest said.

PowerShell is a framework based on .NET. It offers a command-line shell and a scripting language for automating and managing tasks. PowerShell provides full access to system functions like Windows Management Instrumentation (WMI) and Component Object Model (COM) objects.

In addition, it has management features for many other functions such as the Microsoft Exchange server, virtual environments like VMware, or Linux environments. The framework became open source in 2016 and is also available for non-Windows platforms.

Wueest said attackers were using PowerShell because it provided easy access to all major functions of the Windows operating system.

"There are PowerShell scripts for nearly every task, from creating a network sniffer to reading out passwords. Some threats, such as Trojan.Kotver, even attempt to download the PowerShell framework if it isn’t installed on the compromised computer," a detailed research paper from Symantec said.

"Many recent targeted attacks have used PowerShell scripts. For example, the Odinaff group used malicious PowerShell scripts when it attacked financial organisations worldwide," Wueest said. "Common cybercriminals are leveraging PowerShell as well, such as the attackers behind Trojan.Kotver, who use the scripting language to create a fileless infection completely contained in the registry."

PowerShell is installed by default on most Windows computers, and most organisations do not have extended logging enabled for the framework. These two factors make PowerShell a favoured attack tool. Furthermore, scripts can easily be obfuscated and allow for payloads to be executed directly from memory.

The most prevalent malware families that currently use PowerShell are:

  • W97M.Downloader (9.4% of all analysed samples)
  • Trojan.Kotver (4.5%)
  • JS.Downloader (4.0%)

These three threats have been distributed in spam emails.

LEARN NBN TRICKS AND TRAPS WITH FREE NBN SURVIVAL GUIDE

Did you know: Key business communication services may not work on the NBN?

Would your office survive without a phone, fax or email?

Avoid disruption and despair for your business.

Learn the NBN tricks and traps with your FREE 10-page NBN Business Survival Guide

The NBN Business Survival Guide answers your key questions:

· When can I get NBN?
· Will my business phones work?
· Will fax & EFTPOS be affected?
· How much will NBN cost?
· When should I start preparing?

DOWNLOAD NOW!

Sam Varghese

website statistics

A professional journalist with decades of experience, Sam for nine years used DOS and then Windows, which led him to start experimenting with GNU/Linux in 1998. Since then he has written widely about the use of both free and open source software, and the people behind the code. His personal blog is titled Irregular Expression.

 

 

 

 

Connect

Join the iTWire Community and be part of the latest news, invites to exclusive events, whitepapers and educational materials and oppertunities.
Why do I want to receive this daily update?
  • The latest features from iTWire
  • Free whitepaper downloads
  • Industry opportunities