PowerGNN: A source code structural and textual awareness approach for identifying malicious PowerShell scripts

As cyber attacks become more sophisticated, attackers increasingly employ living-off-the-land techniques to evade detection and exploit victim systems, with PowerShell emerging as a primary tool. PowerShell’s deep integration with the Windows operating system makes it an attractive choice for adversaries. Traditional security approaches, which typically rely on rule-based and signature-based detection methods, often struggle to identify novel threats such as zero-day attacks. In response to this challenge, recent advancements in machine learning and deep learning offer new avenues for detecting previously unknown threats by analyzing script characteristics. This study introduces PowerGNN, a novel detection method that leverages Graph Neural Networks (GNN) to analyze the Abstract Syntax Tree (AST) of PowerShell scripts. PowerGNN combines the structural insights provided by the AST with enriched textual features derived from fastText embeddings. By integrating these two approaches, PowerGNN enhances the understanding and detection of malicious scripts. We validate the effectiveness of PowerGNN through experiments, demonstrating its superior ability to detect malicious PowerShell scripts.