RESEARCH ON THE RESPONSE OF WINDOWS SECURITY MECHANISMS TO SCRIPT FILES CREATED USING THE BLOB API
DOI:
https://doi.org/10.28925/2663-4023.2026.35.1404Keywords:
Blob API, Mark of the Web, script files, PowerShell, Microsoft Defender, AMSI, code obfuscation, web securityAbstract
Modern client-side web technologies enable files to be generated directly in a web browser without downloading a complete file from a web server, raising questions about their subsequent handling by operating system security mechanisms. This study aims to experimentally investigate the origin metadata of a script file generated using the Blob API and the response of Windows security mechanisms at the examined stages of its processing and execution. A two-stage experimental chain was implemented: an HTML page used JavaScript, Uint8Array, and the Blob API to generate a .bat file in the browser, and execution of this file initiated the retrieval of a PowerShell script using curl.exe and its execution through powershell.exe. Some string data in the PowerShell script were obfuscated using XOR and Base64. The experiment was conducted in a Windows 11 24H2 environment with Microsoft Defender Antivirus, Microsoft Defender SmartScreen, and the Antimalware Scan Interface (AMSI) enabled. The presence of Mark of the Web was assessed by examining its representation as the NTFS Zone.Identifier alternate data stream. A .bat file downloaded directly from a web resource using the same browser served as the control. In the tested configuration, both files contained a Zone.Identifier stream with ZoneId=3. The experiment also demonstrated that the PowerShell Unblock-File cmdlet removed the Zone.Identifier stream; the warning that the publisher could not be verified was no longer observed when the file was launched again. The experimental chain continued with the retrieval and execution of the PowerShell script and the establishment of command-and-control (C2) communication characteristic of malware remote-control scenarios. Test commands were executed and their results transmitted while Microsoft Defender Antivirus and AMSI remained active and four attack surface reduction (ASR) rules were enabled in block mode. The practical significance of the study lies in demonstrating the need for a comprehensive analysis of the script generation and execution chain, with separate assessment of file-origin metadata and the response of security mechanisms at different processing stages.
Downloads
References
Kaushik, K., Sharma, G., Narooka, P., Chhabra, G., & Vishnoi, A. (2023). HTML smuggling: Attack and mitigation. In 2023 16th International Conference on Security of Information and Networks (SIN) (pp. 1–5). IEEE. https://doi.org/10.1109/SIN60469.2023.10474837
Dora, J. R., & Hluchý, L. (2025). Security review of a client-side code execution with HTML smuggling attack. In 2025 IEEE 12th International Conference on Computational Cybernetics and Cyber-Medical Systems (ICCC) (pp. 131–136). IEEE. https://doi.org/10.1109/ICCC64928.2025.10999118
Wu, M.-H., Hsu, F.-H., Hunag, J.-H., Wang, K., Liu, Y.-Y., Chen, J.-X., Wang, H.-J., & Yang, H.-T. (2024). MPSD: A robust defense mechanism against malicious PowerShell scripts in Windows systems. Electronics, 13(18), Article 3717. https://doi.org/10.3390/electronics13183717
Zhang, S., Li, S., Lu, J., & Yang, W. (2025). Power-ASTNN: A deobfuscation and AST neural network enabled effective detection method for malicious PowerShell scripts. Computers & Security, 154, Article 104441. https://doi.org/10.1016/j.cose.2025.104441
Rose, A. J., Graham, S. R., Schubert Kabban, C. M., Krasnov, J. J., & Henry, W. C. (2024). ScriptBlock smuggling: Uncovering stealthy evasion techniques in PowerShell and .NET environments. Journal of Cybersecurity and Privacy, 4(2), 153–166. https://doi.org/10.3390/jcp4020008
Hendler, D., Kels, S., & Rubin, A. (2018). Detecting malicious PowerShell commands using deep neural networks. In Proceedings of the 2018 Asia Conference on Computer and Communications Security (pp. 187–197). Association for Computing Machinery. https://doi.org/10.1145/3196494.3196511
Hendler, D., Kels, S., & Rubin, A. (2020). AMSI-based detection of malicious PowerShell code using contextual embeddings. In Proceedings of the 15th ACM Asia Conference on Computer and Communications Security (ASIA CCS ’20) (pp. 679–693). Association for Computing Machinery. https://doi.org/10.1145/3320269.3384742
Fang, Y., Zhou, X., & Huang, C. (2021). Effective method for detecting malicious PowerShell scripts based on hybrid features. Neurocomputing, 448, 30–39. https://doi.org/10.1016/j.neucom.2021.03.117
Song, J., Kim, J., Choi, S., Kim, J., & Kim, I. (2021). Evaluations of AI-based malicious PowerShell detection with feature optimizations. ETRI Journal, 43(3), 549–560. https://doi.org/10.4218/etrij.2020-0215
Alahmadi, A., Alkhraan, N., & BinSaeedan, W. (2022). MPSAutodetect: A malicious PowerShell script detection model based on stacked denoising auto-encoder. Computers & Security, 116, Article 102658. https://doi.org/10.1016/j.cose.2022.102658
Xiong, C., Li, Z., Chen, Y., Zhu, T., Wang, J., Yang, H., & Ruan, W. (2022). Generic, efficient, and effective deobfuscation and semantic-aware attack detection for PowerShell scripts. Frontiers of Information Technology & Electronic Engineering, 23(3), 361–381. https://doi.org/10.1631/FITEE.2000436
Chai, H., Ying, L., Duan, H., & Zha, D. (2022). Invoke-Deobfuscation: AST-based and semantics-preserving deobfuscation for PowerShell scripts. In 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) (pp. 295–306). IEEE. https://doi.org/10.1109/DSN53405.2022.00039
Ugarte, D., Maiorca, D., Cara, F., & Giacinto, G. (2019). PowerDrive: Accurate de-obfuscation and analysis of PowerShell malware. In Detection of Intrusions and Malware, and Vulnerability Assessment: 16th International Conference, DIMVA 2019 (pp. 240–259). Springer. https://doi.org/10.1007/978-3-030-22038-9_12
Fu, Z., Song, L., Ding, S. H. H., Alaca, F., & Acharya, S. (2025). Toward a robust detection of PowerShell malware against code mixing and obfuscation by using sentence transformer and similarity learning. ACM Transactions on Privacy and Security, 28(4), Article 55, 1–23. https://doi.org/10.1145/3771542
Sudhakar, & Kumar, S. (2020). An emerging threat fileless malware: A survey and research challenges. Cybersecurity, 3, Article 1. https://doi.org/10.1186/s42400-019-0043-x
MITRE. (n.d.). Obfuscated files or information: HTML smuggling (T1027.006). MITRE ATT&CK. Retrieved September 19, 2026, from https://attack.mitre.org/techniques/T1027/006/
MITRE. (n.d.). Detection strategy for HTML smuggling via JavaScript Blob + dynamic file drop (DET0313). MITRE ATT&CK. Retrieved September 19, 2026, from https://attack.mitre.org/detectionstrategies/DET0313/
Microsoft Threat Intelligence. (2021, November 11). HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks. Microsoft Security Blog. https://www.microsoft.com/en-us/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks
World Wide Web Consortium. (2026, September 12). File API (W3C Working Draft). https://www.w3.org/TR/2026/WD-FileAPI-20260912/
Byeon, H. (2026). Trust propagation failure in the recursive-execution path of nested archives. International Journal of Safety and Security Engineering, 16(3), 503–508. https://doi.org/10.18280/ijsse.160303
Microsoft. (n.d.). [MS-FSCC]: Zone.Identifier stream name. Microsoft Learn. Retrieved September 19, 2026, from https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/6e3f7352-d11c-4d76-8c39-2516a9df36e8
Microsoft. (n.d.). Microsoft Defender SmartScreen overview. Microsoft Learn. Retrieved September 19, 2026, from https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/
Microsoft. (n.d.). Microsoft Defender Antivirus in Windows overview. Microsoft Learn. Retrieved September 20, 2026, from https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-antivirus-windows
Microsoft. (n.d.). Antimalware Scan Interface (AMSI). Microsoft Learn. Retrieved September 19, 2026, from https://learn.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
Microsoft. (n.d.). About execution policies. Microsoft Learn. Retrieved September 20, 2026, from https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-5.1
Published
How to Cite
Issue
Section
License
Copyright (c) 2026 Олег Кириченко, Роман Корольков
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
