AMSI-Based Detection of Malicious PowerShell Code Using Contextual
  Embeddings
  PowerShell is a command-line shell, supporting a scripting language. It is
widely used in organizations for configuration management and task automation
but is also increasingly used by cybercriminals for launching cyberattacks
against organizations, mainly because it is pre-installed on Windows machines
and exposes strong functionality that may be leveraged by attackers. This makes
the problem of detecting malicious PowerShell code both urgent and challenging.
Microsoft's Antimalware Scan Interface (AMSI) allows defending systems to scan
all the code passed to scripting engines such as PowerShell prior to its
execution. In this work, we conduct the first study of malicious PowerShell
code detection using the information made available by AMSI.
  We present several novel deep-learning based detectors of malicious
PowerShell code that employ pretrained contextual embeddings of words from the
PowerShell "language". A known problem in the cybersecurity domain is that
labeled data is relatively scarce in comparison with unlabeled data, making it
difficult to devise effective supervised detection of malicious activity of
many types. This is also the case with PowerShell code. Our work shows that
this problem can be mitigated by learning a pretrained contextual embedding
based on unlabeled data.
  We trained and evaluated our models using real-world data, collected using
AMSI from a large antimalware vendor. Our performance analysis establishes that
the use of unlabeled data for the embedding significantly improved the
performance of our detectors. Our best-performing model uses an architecture
that enables the processing of textual signals from both the character and
token levels and obtains a true positive rate of nearly 90% while maintaining a
low false-positive rate of less than 0.1%.
