{"id":28559917,"url":"https://github.com/ghostpack/invoke-evasion","last_synced_at":"2025-10-14T22:34:58.626Z","repository":{"id":49735544,"uuid":"477996975","full_name":"GhostPack/Invoke-Evasion","owner":"GhostPack","description":"PowerShell Obfuscation and Data Science","archived":false,"fork":false,"pushed_at":"2022-05-04T17:02:16.000Z","size":49273,"stargazers_count":174,"open_issues_count":1,"forks_count":27,"subscribers_count":9,"default_branch":"main","last_synced_at":"2025-06-10T09:06:44.150Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Jupyter Notebook","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/GhostPack.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-04-05T06:08:31.000Z","updated_at":"2025-04-12T23:53:55.000Z","dependencies_parsed_at":"2022-09-01T05:23:05.286Z","dependency_job_id":null,"html_url":"https://github.com/GhostPack/Invoke-Evasion","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/GhostPack/Invoke-Evasion","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FInvoke-Evasion","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FInvoke-Evasion/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FInvoke-Evasion/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FInvoke-Evasion/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/GhostPack","download_url":"https://codeload.github.com/GhostPack/Invoke-Evasion/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/GhostPack%2FInvoke-Evasion/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":279021784,"owners_count":26087056,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-14T02:00:06.444Z","response_time":60,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-10T09:06:43.163Z","updated_at":"2025-10-14T22:34:58.611Z","avatar_url":"https://github.com/GhostPack.png","language":"Jupyter Notebook","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Invoke-Evasion\n\nThis repository contains various datasets, Jupyter notebooks, and machine learning models that accompany the \"Learning Machine Learning\" series of blog posts:\n\n- [Learning Machine Learning Part 1: Introduction and Revoke-Obfuscation](https://posts.specterops.io/learning-machine-learning-part-1-introduction-and-revoke-obfuscation-c73033184f0)\n- [Learning Machine Learning Part 2: Attacking White Box Models](https://posts.specterops.io/learning-machine-learning-part-2-attacking-white-box-models-1a10bbb4a2ae)\n- [Learning Machine Learning Part 3: Attacking Black Box Models](https://posts.specterops.io/learning-machine-learning-part-3-attacking-black-box-models-3efffc256909)\n\n## Structure\n\n./notebooks/\n- **Feature Selection.ipynb** - code for performing the various types of feature selection\n- **LogisticRegression.ipynb** - training a tuned Logistic Regression model on the augmented obfuscated PowerShell dataset\n- **TreeModels.ipynb** - training various tree ensemble models on the augmented obfuscated PowerShell dataset\n- **NeuralNetworks.ipynb** - training various Neural Network models on the augmented obfuscated PowerShell dataset\n- **WhiteBox.ipynb** - white box attacks against the trained Logistic Regression and LightGBM Classifier\n- **WhiteBox-NeutalNetwork.ipynb** - white box attacks against the trained Neural Network\n- **BlackBox.ipynb** - black box attacks against the trained models\n- **BlackBox-Model3.ipynb** - optimization attacks against model 3, the trained Neural Network\n\n\n./models/\n- **tuned_ridge.bin** - Pickled tuned L2 (Ridge) regularized Logistic Regression model pipeline trained on the augmented obfuscated PowerShell dataset\n- **tuned_lgbm.bin** - Pickled tuned LightGBM classifier model trained on the augmented obfuscated PowerShell dataset\n- **./neural_network/** - Saved model weights for a 4-layer 192 neuron Neural Network with a dropout of .5\n\n\n./datasets/\n- **PowerShellCorpus.ast.csv.7z** - compressed csv of AST features extracted from an augmented PowerShell corpus dataset of 14702 samples\n- **BlackBoxData.ast.csv.7z** - compressed csv of AST features extracted from a subset of the PowerShell corpus (3000 samples)\n\n\n./PS-AST/\n- C# project that integrates the [checks from Revoke-Obfuscation](https://github.com/danielbohannon/Revoke-Obfuscation/tree/master/Checks) (by Daniel Bohannon \u0026 Lee Holmes, Apache License 2.0) for AST file generation. Also contains **SplitScriptFunctions** that outputs every function in a script to a separate file, used for data augmentation.\n\n./samples/\n- Various adversarial samples generated by white/black box evasion methods\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostpack%2Finvoke-evasion","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fghostpack%2Finvoke-evasion","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fghostpack%2Finvoke-evasion/lists"}