https://github.com/adobe/obfuscation-detection
https://github.com/adobe/obfuscation-detection
Last synced: 5 days ago
JSON representation
- Host: GitHub
- URL: https://github.com/adobe/obfuscation-detection
- Owner: adobe
- License: apache-2.0
- Created: 2021-08-03T15:50:57.000Z (about 5 years ago)
- Default Branch: main
- Last Pushed: 2025-05-22T23:24:47.000Z (about 1 year ago)
- Last Synced: 2026-04-26T16:12:40.234Z (3 months ago)
- Language: Python
- Size: 47.5 MB
- Stars: 43
- Watchers: 8
- Forks: 10
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
Awesome Lists containing this project
README
# Command Obfuscation Detection
This project currently only supports cmd.exe command obfuscation detection on Windows. In a previous iteration of this project, we used deep learning. Now, we have shifted the approach towards XGBoost instead.
- Blog post: https://medium.com/adobetech/using-deep-learning-to-better-detect-command-obfuscation-965b448973e0
- Pip package: https://pypi.org/project/obfuscation-detection/
## Quick Installation
You can install our package through pip!
```
pip install obfuscation-detection
```
This is a basic usage of our package:
```
from obfuscation_detection import ObfuscationDetectionClassifier
model = ObfuscationDetectionClassifier()
commands = ['cmd.exe /c "echo Invoke-DOSfuscation"',
'cm%windir:~ -4, -3%.e^Xe,;^,/^C",;,S^Et ^^o^=fus^cat^ion&,;,^se^T ^ ^ ^B^=o^ke-D^OS&&,;,s^Et^^ d^=ec^ho I^nv&&,;,C^Al^l,;,^%^D%^%B%^%o^%"',
'cat /etc/passwd']
y = model.predict(commands)
y_prob = model.predict_proba(commands)
# 1 is obfuscated, 0 is non-obfuscated
print(y) # [0, 1, 0]
print(y_prob)
```
## Usage
1. Install python dependencies: `pip install -r requirements.txt`
2. For quick usage, give a .csv file with column `commands` and you can run the commands through the model: `python obfuscation_detection/main.py --filename commands.csv`
3. You can also write your own scripts to use the model class directly: `python obfuscation_detection/model.py`
### Contributing
Contributions are welcomed! Read the [Contributing Guide](./CONTRIBUTING.md) for more information.
### Licensing
This project is licensed under the Apache V2 License. See [LICENSE](LICENSE) for more information.