# AMSI-Based Detection of Malicious PowerShell Code Using Contextual Embeddings

**Authors:** Amir Rubin, Shay Kels, Danny Hendler  
**arXiv:** [1905.09538](https://arxiv.org/abs/1905.09538)  
**Date:** 2019-05-23  
**Summary page:** https://www.summarizepaper.com/en/paper/1905.09538v2/

## Key points

- PowerShell is a widely used command-line shell and scripting language for configuration management and task automation in organizations.
- Malicious PowerShell code poses a threat as cybercriminals target it for attacks.
- Microsoft's Antimalware Scan Interface (AMSI) allows systems to scan PowerShell code before execution.
- The authors of the study investigated using AMSI information to detect malicious PowerShell code.
- They developed deep-learning based detectors that utilize pretrained contextual embeddings of words from the language.
- Learning a pretrained contextual embedding based on unlabeled data helps mitigate the scarcity of labeled data in cybersecurity.
- Real-world data collected through AMSI from a large antimalware vendor was used to train and evaluate the models.
- Incorporating unlabeled data for embedding showed significant improvement in detection performance.
- The best-performing model processed textual signals at both character and token levels, achieving a true positive rate of nearly 90% with a low false-positive rate of less than 0.1%.
- Leveraging AMSI and deep learning techniques is important for effective detection of malicious PowerShell code, especially when labeled datasets are limited in cybersecurity domains like PowerShell code analysis.

## Summary

PowerShell is a widely used command-line shell and scripting language for configuration management and task automation in organizations. However, its powerful functionality has also made it a target for cybercriminals to launch attacks. Detecting malicious PowerShell code is challenging, but Microsoft's Antimalware Scan Interface (AMSI) provides a solution by allowing systems to scan code before execution. In this study, the authors investigated using AMSI information to detect malicious PowerShell code and developed deep-learning based detectors that utilize pretrained contextual embeddings of words from the language. The scarcity of labeled data in cybersecurity makes supervised detection difficult, but the authors showed that learning a pretrained contextual embedding based on unlabeled data can help mitigate this issue. The models were trained and evaluated using real-world data collected through AMSI from a large antimalware vendor, with results showing significant improvement when incorporating unlabeled data for embedding. The best-performing model utilized an architecture capable of processing textual signals at both character and token levels, achieving a true positive rate of nearly 90% while maintaining a low false-positive rate of less than 0.1%. This research highlights the importance of leveraging AMSI and deep learning techniques for effective detection of malicious PowerShell code, especially in the face of limited labeled datasets in cybersecurity domains like PowerShell code analysis.