Powershell Deobfuscation: Putting the toothpaste back in the tube

In an effort to provide analysts with a clearer picture of what happened after exploitation and save them time, we've developed a tool for detecting and deobfuscating obfuscated Powershell scripts. This starts with a machine learning classifier to determine if a file is obfuscated or encoded, reversing any encoding any easy to decipher obfuscation found, and then finishing up the more difficult deobfuscation tasks using a neural network text translation framework.

Presented by