Abstract
Multi-stage PowerShell malware represents a highly persistent threat in modern cyber-attacks, leveraging advanced obfuscation techniques to bypass traditional static detection engines. In this paper, we propose a novel framework for detecting and deobfuscating multi-stage PowerShell malware by performing ensemble deep learning on dynamic API call sequences. By executing samples in an instrumented sandbox, we capture the runtime invocation of Windows API calls, effectively bypassing static obfuscation layers. Our proposed ensemble model integrates Bidirectional Long Short-Term Memory (BiLSTM) networks, Gated Recurrent Units (GRU), and Convolutional Neural Networks (CNN) with an attention mechanism to extract both local spatial patterns and long-term temporal dependencies from API call sequences. Evaluated on a comprehensive dataset of 12,450 benign and malicious PowerShell scripts, our model achieves a classification accuracy of 98.7% and a false-positive rate of 0.45%. Furthermore, the framework successfully maps the sequential execution flow of highly obfuscated payloads, providing digital forensic investigators with actionable behavioral intelligence. These findings demonstrate that combining dynamic API sequence analysis with ensemble deep learning significantly enhances enterprise resilience against sophisticated fileless threats.
