Detecting Fileless Cryptojacking in PowerShell Using AST-Enhanced CodeBERT Models
Fuente:
arXiv
Gespeichert in:
| Hauptverfasser: | , , , , |
|---|---|
| Format: | Preprint |
| Veröffentlicht: |
2026
|
| Schlagworte: | |
| Online-Zugang: | |
| Tags: |
Tag hinzufügen
Keine Tags, Fügen Sie den ersten Tag hinzu!
|
| _version_ | 1866911544900583424 |
|---|---|
| author | Varlioglu, Said Elsayed, Nelly Ozer, Murat ElSayed, Zag Emmert, John M. |
| author_facet | Varlioglu, Said Elsayed, Nelly Ozer, Murat ElSayed, Zag Emmert, John M. |
| contents | With the emergence of remote code execution (RCE) vulnerabilities in ubiquitous libraries and advanced social engineering techniques, threat actors have started conducting widespread fileless cryptojacking attacks. These attacks have become effective with stealthy techniques based on PowerShell-based exploitation in Windows OS environments. Even if attacks are detected and malicious scripts removed, processes may remain operational on victim endpoints, creating a significant challenge for detection mechanisms. In this paper, we conducted an experimental study with a collected dataset on detecting PowerShell-based fileless cryptojacking scripts. The results showed that Abstract Syntax Tree (AST)-based fine-tuned CodeBERT achieved a high recall rate, proving the importance of the use of AST integration and fine-tuned pre-trained models for programming language. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_18285 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Detecting Fileless Cryptojacking in PowerShell Using AST-Enhanced CodeBERT Models Varlioglu, Said Elsayed, Nelly Ozer, Murat ElSayed, Zag Emmert, John M. Cryptography and Security With the emergence of remote code execution (RCE) vulnerabilities in ubiquitous libraries and advanced social engineering techniques, threat actors have started conducting widespread fileless cryptojacking attacks. These attacks have become effective with stealthy techniques based on PowerShell-based exploitation in Windows OS environments. Even if attacks are detected and malicious scripts removed, processes may remain operational on victim endpoints, creating a significant challenge for detection mechanisms. In this paper, we conducted an experimental study with a collected dataset on detecting PowerShell-based fileless cryptojacking scripts. The results showed that Abstract Syntax Tree (AST)-based fine-tuned CodeBERT achieved a high recall rate, proving the importance of the use of AST integration and fine-tuned pre-trained models for programming language. |
| title | Detecting Fileless Cryptojacking in PowerShell Using AST-Enhanced CodeBERT Models |
| topic | Cryptography and Security |
| url | https://arxiv.org/abs/2602.18285 |