With the emergence of remote code execution (RCE) vulnerabilities in ubiquitous libraries and advanced social engineering techniques, threat actors have started conducting widespread fileless cryptojacking attacks. These attacks have become effective with stealthy techniques based on PowerShell-based exploitation in Windows OS environments. Even if attacks are detected and malicious scripts removed, processes may remain operational on victim endpoints, creating a significant challenge for detection mechanisms. In this paper, we conducted an experimental study with a collected dataset on detecting PowerShell-based fileless cryptojacking scripts. The results showed that Abstract Syntax Tree (AST)-based fine-tuned CodeBERT achieved a high recall rate, proving the importance of the use of AST integration and fine-tuned pre-trained models for programming language.

翻译：随着普遍存在的库中远程代码执行漏洞的出现以及高级社会工程学技术的发展，威胁行为者已开始广泛实施无文件加密劫持攻击。这些攻击在Windows操作系统环境中，通过基于PowerShell的隐蔽利用技术变得极为有效。即使攻击被检测到且恶意脚本被清除，相关进程仍可能在受害终端上持续运行，这给检测机制带来了重大挑战。本文利用收集的数据集，对基于PowerShell的无文件加密劫持脚本检测进行了实验研究。结果表明，基于抽象语法树微调的CodeBERT模型实现了较高的召回率，这证明了集成抽象语法树以及使用针对编程语言微调的预训练模型的重要性。