{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,11,7]],"date-time":"2025-11-07T13:41:47Z","timestamp":1762522907873,"version":"build-2065373602"},"reference-count":28,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2024,3,25]],"date-time":"2024-03-25T00:00:00Z","timestamp":1711324800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["JCP"],"abstract":"<jats:p>The Antimalware Scan Interface (AMSI) plays a crucial role in detecting malware within Windows operating systems. This paper presents ScriptBlock Smuggling, a novel evasion and log spoofing technique exploiting PowerShell and .NET environments to circumvent the AMSI. By focusing on the manipulation of ScriptBlocks within the Abstract Syntax Tree (AST), this method creates dual AST representations, one for compiler execution and another for antivirus and log analysis, enabling the evasion of AMSI detection and challenging traditional memory patching bypass methods. This research provides a detailed analysis of PowerShell\u2019s ScriptBlock creation and its inherent security features and pinpoints critical limitations in the AMSI\u2019s capabilities to scrutinize ScriptBlocks and the implications of log spoofing as part of this evasion method. The findings highlight potential avenues for attackers to exploit these vulnerabilities, suggesting the possibility of a new class of AMSI bypasses and their use for log spoofing. In response, this paper proposes a synchronization strategy for ASTs, intended to unify the compilation and malware scanning processes to reduce the threat surfaces in PowerShell and .NET environments.<\/jats:p>","DOI":"10.3390\/jcp4020008","type":"journal-article","created":{"date-parts":[[2024,3,25]],"date-time":"2024-03-25T14:14:12Z","timestamp":1711376052000},"page":"153-166","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":2,"title":["ScriptBlock Smuggling: Uncovering Stealthy Evasion Techniques in PowerShell and .NET Environments"],"prefix":"10.3390","volume":"4","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-2801-2009","authenticated-orcid":false,"given":"Anthony J.","family":"Rose","sequence":"first","affiliation":[{"name":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0193-1192","authenticated-orcid":false,"given":"Scott R.","family":"Graham","sequence":"additional","affiliation":[{"name":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9778-0813","authenticated-orcid":false,"given":"Christine M.","family":"Schubert Kabban","sequence":"additional","affiliation":[{"name":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0000-4719-1594","authenticated-orcid":false,"given":"Jacob J.","family":"Krasnov","sequence":"additional","affiliation":[{"name":"Independent Researcher, 1050 E Flamingo Road Suite 107, Las Vegas, NV 89119, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3646-6892","authenticated-orcid":false,"given":"Wayne C.","family":"Henry","sequence":"additional","affiliation":[{"name":"Air Force Institute of Technology, 2950 Hobson Way, Wright-Patterson AFB, OH 45433, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2024,3,25]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Grenfeldt, M., Olofsson, A., Engstr\u00f6m, V., and Lagerstr\u00f6m, R. (2021, January 25\u201329). Attacking Websites Using HTTP Request Smuggling: Empirical Testing of Servers and Proxies. Proceedings of the 2021 IEEE 25th International Enterprise Distributed Object Computing Conference (EDOC), Gold Coast, Australia.","DOI":"10.1109\/EDOC52215.2021.00028"},{"key":"ref_2","unstructured":"Korkos, M. (2023, September 20). AMSI Unchained: Review of Known AMSI Bypass Techniques and Introducing a New One. Available online: https:\/\/i.blackhat.com\/Asia-22\/Friday-Materials\/AS-22-Korkos-AMSI-and-Bypass.pdf."},{"key":"ref_3","unstructured":"Microsoft Security Response Team (2024, March 19). CVE-2020-1472 (ZeroLogon). Available online: https:\/\/msrc.microsoft.com\/update-guide\/en-US\/advisory\/CVE-2020-1472."},{"key":"ref_4","first-page":"19","article-title":"Language Integration in the Common Language Runtime","volume":"38","author":"Hamilton","year":"2003","journal-title":"ACM Spec. Interest Group Program. Lang."},{"key":"ref_5","unstructured":"Warren, G., Wagner, B., Wenzel, M., Lee, D., Maddock, C., Jones, M., Blome, M., Latham, L., Onderka, P., and Sal, A. (2024, March 19). What Is \u201cManaged Code\u201d?. Available online: https:\/\/learn.microsoft.com\/en-us\/dotnet\/standard\/managed-code."},{"key":"ref_6","unstructured":"Chakraborti, A., Kranti, U., and Sandhu, R.J. (2002). NET Framework: Professional Projects, Premier Press."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"679","DOI":"10.1016\/j.sysarc.2007.11.004","article-title":"A quantitative analysis of the .NET common language runtime","volume":"54","author":"Dick","year":"2008","journal-title":"J. Syst. Archit."},{"key":"ref_8","unstructured":"CoreCLR (2024, March 19). DotNET Platform. GitHub. Available online: https:\/\/github.com\/dotnet\/runtime."},{"key":"ref_9","unstructured":"Tsirpanis, T., and Toub, S. (2024, March 19). The Book of the Runtime. Available online: https:\/\/github.com\/dotnet\/runtime\/tree\/main\/docs\/design\/coreclr\/botr."},{"key":"ref_10","unstructured":"Payette, B., and Siddaway, R. (2017). Windows PowerShell in Action, Simon and Schuster. [3rd ed.]."},{"key":"ref_11","unstructured":"Ashcraft, A., Jacobs, M., and Satran, M. (2023, August 23). Antimalware Scan Interface (AMSI). Available online: https:\/\/docs.microsoft.com\/en-us\/windows\/desktop\/amsi\/antimalware-scan-interface-portal."},{"key":"ref_12","unstructured":"Warren, G., Kulikov, P., Wagner, B., Overfield, T., Pine, D., Sharkey, K., Coulter, D., Swimberghe, N., DesArmo, B., and Victor, Y. (2024, March 19). What Is New in.NET Framework. Available online: https:\/\/learn.microsoft.com\/en-us\/dotnet\/framework\/whats-new\/#v48."},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3603506","article-title":"IronNetInjector: Weaponizing .NET Dynamic Language Runtime Engines","volume":"4","author":"Rose","year":"2023","journal-title":"Digit. Threat. Res. Pract."},{"key":"ref_14","unstructured":"Aho, A.V. (2007). Compilers: Principles, Techniques, & Tools, Pearson\/Addison Wesley."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"225","DOI":"10.1016\/0096-0551(85)90018-9","article-title":"An algorithm for generating abstract syntax trees","volume":"10","author":"Noonan","year":"1985","journal-title":"Comput. Lang."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Xu, X., Liu, S., Yu, P., and Zhao, Y. (2021, January 4\u20136). Research on PowerShell obfuscation technology based on Abstract Syntax Tree Transformation. Proceedings of the 2021 International Symposium on Computer Technology and Information Science (ISCTIS), Guilin, China.","DOI":"10.1109\/ISCTIS51085.2021.00032"},{"key":"ref_17","unstructured":"Microsoft (2024, March 19). AST Class. Available online: https:\/\/learn.microsoft.com\/en-us\/dotnet\/api\/system.management.automation.language.ast?view=powershellsdk-7.2.0."},{"key":"ref_18","unstructured":"Microsoft (2024, March 19). ScriptBlock Class. Available online: https:\/\/learn.microsoft.com\/en-us\/dotnet\/api\/system.management.automation.scriptblock?view=powershellsdk-7.2.0."},{"key":"ref_19","unstructured":"Microsoft (2024, March 19). ScriptBlockAst Class. Available online: https:\/\/learn.microsoft.com\/en-us\/dotnet\/api\/system.management.automation.language.scriptblockast?view=powershellsdk-7.3.0."},{"key":"ref_20","unstructured":"Wheeler, S., and Lombardi, M. (2024, March 19). About Logging Windows. Available online: https:\/\/learn.microsoft.com\/en-us\/powershell\/module\/microsoft.powershell.core\/about\/about_logging_windows?view=powershell-7.3."},{"key":"ref_21","unstructured":"PowerShell Core (2024, March 19). PowerShell Team. Github. Available online: https:\/\/github.com\/PowerShell\/PowerShell."},{"key":"ref_22","unstructured":"PowerShell\/CompiledScriptBlock (2024, March 19). PowerShell Team. Available online: https:\/\/github.com\/PowerShell\/PowerShell\/blob\/9662f028f6c3fd173995ef77e5f26e65fb3fd1acb\/src\/System.Management.Automation\/engine\/runtime\/CompiledScriptBlock.cs#LL216C40-L216C51."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Pan, Z., Chen, Y., Chen, Y., Shen, Y., and Li, Y. (2022). LogInjector: Detecting Web Application Log Injection Vulnerabilities. Appl. Sci., 12.","DOI":"10.3390\/app12157681"},{"key":"ref_24","unstructured":"PowerShell Empire (2024, March 19). BC Security. Github. Available online: https:\/\/github.com\/BC-SECURITY\/Empire."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"30","DOI":"10.1016\/j.neucom.2021.03.117","article-title":"Effective method for detecting malicious PowerShell scripts based on hybrid features","volume":"448","author":"Fang","year":"2021","journal-title":"Neurocomputing"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Hendler, D., Kels, S., and Rubin, A. (2018, January 4\u20138). Detecting Malicious PowerShell Commands using Deep Neural Networks. Proceedings of the 2018 on Asia Conference on Computer and Communications Security (ASIACCS \u201918), Incheon, Republic of Korea.","DOI":"10.1145\/3196494.3196511"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Rusak, G., Al-Dujaili, A., and O\u2019Reilly, U. (2018, January 15\u201319). AST-Based Deep Learning for Detecting Malicious PowerShell. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security, Toronto, ON, Canada.","DOI":"10.1145\/3243734.3278496"},{"key":"ref_28","first-page":"549","article-title":"Evaluations of AI-based malicious PowerShell detection with feature optimizations","volume":"43","author":"Song","year":"2021","journal-title":"Electron. Telecommun. Res. Inst. J."}],"container-title":["Journal of Cybersecurity and Privacy"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2624-800X\/4\/2\/8\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T14:17:59Z","timestamp":1760105879000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2624-800X\/4\/2\/8"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,3,25]]},"references-count":28,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2024,6]]}},"alternative-id":["jcp4020008"],"URL":"https:\/\/doi.org\/10.3390\/jcp4020008","relation":{},"ISSN":["2624-800X"],"issn-type":[{"type":"electronic","value":"2624-800X"}],"subject":[],"published":{"date-parts":[[2024,3,25]]}}}