The Power of Words: Generating PowerShell Attacks from Natural Language
summary
Paper shows NMT models fine tuned to PowerShell with domain-adaptive pretraining on about 990,000 scripts and supervised fine tuning on ~1,100 offensive samples covering 12–14 ATT&CK tactics. Static checks report parse-accuracy above 90% and up to 98% for top models, CodeT5+ leads token-similarity, and dynamic sandbox runs on Windows 10 (35 test entries) yield an execution F1 >88%. Customized models outperform ChatGPT 3.5 on behavioral and similarity metrics.
AI-written summary · about
chapters (12)
- 0:00Research introduction
- 1:54Offensive security importance
- 3:40PowerShell for Windows attacks
- 5:04Generating PowerShell from text
- 6:26Pre-training on PowerShell code
- 7:11Fine-tuning for offensive PowerShell
- 8:58Evaluating code similarity
- 11:43Syntactic analysis of PowerShell
- 13:50Execution analysis of code
- 16:41ChatGPT performance comparison
- 18:28Conclusions and future work
- 19:15Q&A
related talks
01h 40mDefending against PowerShell attacks - in theory, and in practice
16mSoK: Automated TTP Extraction from CTI Reports – Are We There Yet?
31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity
25mInvestigating PowerShell Attacks
49mChatGPT: A New Generation of Dynamic Machine Based Attacks?
45mPowershell Kung-Fu
50mThe ART of Probable: Test with AI, Atomic Red Team, and Threat Metrics
30mBattling the Machine: Cutting-Edge Attacks and Defenses in Generative AI