Detecting, Deobfuscating, and Preventing Obfuscated Script Execution with Tree-sitter

The talk starts with why attackers obfuscate scripts in PowerShell, Python and JavaScript: to slow reverse engineering and to get past signature scanners. It reviews existing approaches, such as dynamic deobfuscators that run scripts in a PowerShell environment, and explains why they are heavyweight, hard to run at enterprise scale, and fragile on broken code.

The core method parses scripts into syntax trees with tree-sitter and applies small, repeatable transformations: joining split strings, resolving format strings, undoing type casts, and unpacking Base64 and gzip blobs. Each rule can store inferred values that later rules use, and the loop runs until no more changes apply. On several hundred clean management scripts run through obfuscation, the speaker reported that tree-sitter queries found far more obfuscated files than YARA rules did, 616 hits against 86. The speaker also built a custom AMSI provider DLL in Rust that scans script buffers, logs payloads, blocks suspicious content, and flags unusual variable names by entropy.

In a live demo, the provider unwrapped a gzip-compressed download and exposed strings hidden in a rootkit's AMSI bypass. The speaker noted limits: the engine is not feature complete, and it does not yet follow imported modules across a session. The takeaway for practitioners is that syntax-aware rules can strengthen existing signature engines such as YARA rather than replace them.