> For the complete documentation index, see [llms.txt](https://nuclei-av.gitbook.io/malware-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nuclei-av.gitbook.io/malware-handbook/malware-analysis/malware-analysis-methodologies/analyzing-powershell-scripts.md).

# Analyzing PowerShell Scripts

**1. Understanding PowerShell Scripts:**

* **Threat Actor Use:**
  * PowerShell scripts are popular among threat actors for post-exploitation activities.
* **Identifying PowerShell Scripts:**
  * Familiarity with PowerShell syntax is crucial. Common keywords include:
    * **`function`**: Defines a function.
    * **`Set-Alias`**: Creates an alias for a cmdlet or function.
    * **`IEX (Invoke-Expression)`**: Executes a string or script passed to it.

**2. Tools for Analysis:**

* **Text Editor for Static Analysis:**
  * View the script in a text editor for basic, static analysis.
* **PowerShell ISE (Integrated Scripting Environment):**
  * An IDE tool by Microsoft for developing and debugging PowerShell scripts.
  * Pre-installed on Windows, useful for dynamic analysis.

**3. Practical Analysis:**

* **Sample File Analysis: (say)**
  * Analyze `re_test_dlx.ps1` using PowerShell ISE.
  * **Initial Check:**
    * Use tools like **Detect It Easy** to verify the script is in plain text format.
* **Loading the Script:**
  * Open the script in PowerShell ISE.
  * Long lines in the script may require horizontal scrolling as PowerShell ISE lacks word wrapping.
* **Beautifying the Script:**
  * Break down complex, long lines to improve readability.
  * Use code formatting techniques like:
    * **Curly Braces (`{}`)**: Expand functions based on these brackets.
    * **Semi-Colons (`;`)**: Break down lines at each semi-colon.
  * Alternatively, use external code beautification tools for better results.
* **Identifying Functions:**
  * Look for functions like `encode` and analyze their content.
  * Example: A function that decodes a Base64 string can be manually decoded using tools like **CyberChef**.

**4. Debugging the Script:**

* **Setting Breakpoints:**
  * Use **F9** to set breakpoints.
  * Example: Set a breakpoint at the **Set-Alias** command to intercept script execution.
* **Debugging Process:**
  * **Set-Alias Command:**
    * Associates `XXX` as an alias for the `IEX` function, enabling `XXX` to execute scripts.
  * **Execution Interception:**
    * Replace `IEX` with `Write-Host` to output the script to the console instead of executing it.
* **Handling Pipes (`|`):**
  * Pipes are used to pass the output from one command to another.
  * **Alternative Debugging:**
    * Break the script at pipes and introduce variables to capture intermediate outputs.
    * Example: Capture and inspect the content of the variable `temp` before execution.

**5. Final Analysis:**

* **Decrypted Data:**
  * The decrypted data reveals another PowerShell script designed to download and execute an executable from `www.evil.com`.
* **Resources:**
  * For further analysis, refer to:
    * **PowerShell ISE** for debugging.
    * **Microsoft's Website** for PowerShell syntax and standard functions.

#### **Key Takeaways:**

* **PowerShell ISE:**
  * A powerful tool for dynamically analyzing and debugging PowerShell scripts.
* **Debugging Techniques:**
  * Intercepting script execution and replacing key functions can reveal hidden behaviors.
* **Use of External Tools:**
  * Tools like **CyberChef** are essential for decoding and analyzing encoded data within scripts.
* **Understanding Syntax:**
  * Familiarity with PowerShell syntax is critical for effective script analysis and detection of malicious activities.