With the emergence of remote code execution (RCE) vulnerabilities in ubiquitous libraries and advanced social engineering techniques, threat actors have started conducting widespread fileless cryptojacking attacks. These attacks have become effective with stealthy techniques based on PowerShell-based exploitation in Windows OS environments. Even if attacks are detected and malicious scripts removed, processes may remain operational on victim endpoints, creating a significant challenge for detection mechanisms. In this paper, we conducted an experimental study with a collected dataset on detecting PowerShell-based fileless cryptojacking scripts. The results showed that Abstract Syntax Tree (AST)-based fine-tuned CodeBERT achieved a high recall rate, proving the importance of the use of AST integration and fine-tuned pre-trained models for programming language.

翻译：随着通用库中远程代码执行（RCE）漏洞的出现以及复杂社会工程学技术的演进，威胁行为者开始广泛实施无文件型加密货币劫持攻击。此类攻击凭借基于Windows操作系统环境中PowerShell利用的隐蔽技术已具备高效性。即便攻击被检测到且恶意脚本被清除，受攻击端点上的进程仍可能持续运行，这给检测机制带来了重大挑战。本文通过自建数据集对基于PowerShell的无文件型加密货币劫持脚本检测开展了实验研究。结果表明，基于抽象语法树（AST）微调的CodeBERT模型实现了高召回率，充分证明了AST集成与面向编程语言的微调预训练模型的应用价值。