# ScriptBlock Smuggling: Uncovering Stealthy Evasion Techniques in PowerShell and.NET Environments
## 1 Introduction  
PowerShell has become an indispensable tool for system administrators, primarily due to its ability to create and execute ScriptBlocks, which are composable, reusable, and modifiable blocks of code. Built on the.NET Framework, PowerShell has revolutionized the management and automation of various tasks on Windows systems. However, the security landscape has become increasingly challenging with the emergence of sophisticated evasion techniques. This article explores ScriptBlock Smuggling, a novel evasion technique that, to the best of the authors' knowledge, has not been deployed in real-world scenarios. The technique leverages PowerShell's ability to alter ScriptBlocks, thereby enabling the circumvention of the Antimalware Scan Interface (AMSI). It is crucial to emphasize that, despite its demonstrated potential, there is no current evidence of its use in actual attacks. ScriptBlock Smuggling takes advantage of PowerShell's capacity to modify the arbitrary representation of the Abstract Syntax Tree (AST) in ScriptBlocks. The name \"smuggling\" is derived from the ability to sneak code through to compilation, similar to HTTP request smuggling [1]. This manipulation results in two distinct sets of ASTs: one sent to the compiler for execution and another that is logged and monitored by the system's antivirus. Consequently, this technique enables malware to completely evade detection when scanned by the AMSI, circumventing the need for memory patching bypasses [2]. This article presents a thorough analysis of the standard method of creating ScriptBlocks and the security features of PowerShell, with the aim of showcasing the implicationsof ScriptBlock Smuggling. It specifically focuses on the limitations of these security features in examining ScriptBlock ASTs and exploring how these weaknesses could potentially be exploited by Advanced Persistent Threats (APTs) to evade detection and circumvent security protocols. For the purpose of this paper, only a limited set of subtrees and branches in PowerShell ASTs needs to be addressed. By examining the intricacies of ScriptBlock Smuggling and its impact on PowerShell's security landscape, the aim is to contribute to the ongoing development of more robust security measures and better understand the challenges associated with defending against novel evasion techniques. The research presented herein thoroughly examines PowerShell's methods for interpreting text blocks, its AST representation of ScriptBlocks, and the security implications surrounding the Extent and EndBlock AST nodes. Furthermore, we examine the role of the.NET Framework and the AMSI, integral components of the Windows ecosystem that work in tandem to ensure seamless and secure operations. By providing a comprehensive understanding of these interconnected elements, we can shed light on the underlying structure, properties, and security implications of PowerShell's ScriptBlocks and their interplay with the.NET Framework and the AMSI. This research has been previously disclosed to Microsoft as part of responsible disclosure. To our knowledge, Microsoft has not implemented a fix as of the time of this article. We recognize the challenges facing vendors as a result of discovering vulnerabilities and understand that not all vulnerabilities will be addressed quickly. However, there is a danger of delay. For example, Microsoft initially underestimated the severity of the ZeroLogon vulnerability, labeling it as \"unlikely to be exploited\" [3]. Sadly, this vulnerability was exploited by attackers within days of its publication. Underestimating security vulnerabilities is unfortunately common, a stance with which we respectfully but firmly disagree with. This paper introduces ScriptBlock Smuggling as a distinct class of AMSI bypasses. Unlike traditional bypass techniques that primarily rely on memory patching or reflection, ScriptBlock Smuggling represents a paradigm shift in evasion tactics. It exploits inherent weaknesses in PowerShell's AST handling, a method not previously explored.