AI-Generated PowerShell Malware: An Experimental Framework and Dataset
For cybersecurity analysts, it provides tools and data to assess the threat of AI-generated malware, though the approach is incremental.
The paper proposes a framework and dataset for analyzing LLM-generated PowerShell malware, finding high similarity (median Jaccard index 84.5%) between real and AI-generated malware in triggered OS events.
Generative AI has emerged as a significant cybersecurity threat, with several recent attack campaigns leveraging LLMs to generate code for malicious purposes via scripting languages such as PowerShell. Consequently, for cybersecurity analysts, it is imperative to investigate the offensive capabilities of AI code generators. In this paper, we propose an experimental framework to assess LLM-generated PowerShell malware, which comprises a novel sandbox approach for dynamic analysis of AI-generated malware. Furthermore, we present a novel, manually curated dataset of real-world PowerShell malware, annotated in natural language to assist the training and evaluation of LLMs. Finally, this study evaluates permissive, open-weight LLMs adapted to PowerShell malware generation. Our results reveal a high degree of similarity between real malware and LLM-generated ones in terms of triggered OS malicious events, with a median Jaccard index of 84.5% and 48.4% of instances achieving complete overlap.