Research on PowerShell Obfuscation Technology Based on Abstract Syntax Tree Transformation

In recent years, PowerShell scripts can be easily obfuscated and widely used due to its usability and flexibility. However, anti-obfuscation tools such as PowerShellProfiler and CyberChef also developed rapidly. In order to improve the security of scripts, this paper proposes a PowerShell obfuscation technology based on abstract syntax tree transformation. Firstly, this technology performs the equivalent replacement of the grammatical structure in the script. In addition, it also changes the sequence of the child nodes of the abstract syntax tree. Finally,it obfuscates the PSToken in the script. Thus, this technology can make up for the defects of the traditional obfuscation technology, and hide the program logic better to improve the concealment of the script. The experimental results show that the use of this technology proposed in this paper can improve the strength of obfuscation over 82.7% on average, which is 16% higher than traditional obfuscation technology. Moreover, this method is more effective against anti-obfuscation tools.