Detection of PowerShell Shellcode Runner
One of the advantages of using the PowerShell shellcode runner
is the fact that no first-stage shellcode is embedded in the document
that is sent to the victim.
We accomplished this with a PowerShell download cradle
that fetches and executes the full shellcode.
Since this code contains no shellcode,
we would expect a very low signature detection rate.
However, this code is flagged by eight products,
which is surprisingly higher than a Microsoft Word document
containing an unencrypted Meterpreter shellcode.
There are two main issues that cause the high detection rate:
the use of the Shell method,
and the clearly identifiable PowerShell download cradle.
Let’s address the Shell method first.
When the PowerShell process is created directly from the VBA code through Shell,
it becomes a child process of Microsoft Word.
This is suspicious behavior
and we can’t easily obfuscate this VBA function name.