{"id":73112,"date":"2026-07-16T15:20:34","date_gmt":"2026-07-16T15:20:34","guid":{"rendered":"https:\/\/socs.binus.ac.id\/cyber-security\/?p=73112"},"modified":"2026-07-16T15:20:34","modified_gmt":"2026-07-16T15:20:34","slug":"plaguards","status":"publish","type":"post","link":"https:\/\/socs.binus.ac.id\/cyber-security\/2026\/07\/16\/plaguards\/","title":{"rendered":"Plaguards"},"content":{"rendered":"

Reading the Script That Was Written to Be Unreadable<\/strong><\/p>\n

An incident responder opens a suspicious PowerShell script and finds a wall of nonsense. Strings sliced into fragments and glued back together, base64 nested inside base64, backticks scattered through keywords, characters assembled from arithmetic. None of it is meant to be understood by a human. It is meant to get past your defenses and run, and it usually does, because PowerShell is already installed on every Windows machine and leaves no file on disk to scan. Plaguards was built for the analyst staring at that wall at two in the morning.<\/p>\n

It is an open source PowerShell deobfuscation and IOC detection engine aimed squarely at blue teams. The project’s own account of why it exists is telling. Deobfuscation tools for JavaScript are plentiful, but static deobfuscation resources for PowerShell are scarce, and most existing tools only detect that a script is obfuscated rather than actually unwrapping it. That leaves incident response teams facing fileless PowerShell attacks, a staple of modern malware and ransomware, without the one thing they need most, which is to see what the script actually does.<\/p>\n

Plaguards unwraps it methodically. It concatenates split strings and variables, decodes base64 across multiple patterns, evaluates backticks and whitespace tricks, splits chained code on semicolons, resolves arithmetic used to construct characters including XOR, and evaluates replace, split, and join operations along with ASCII string conversion. Each of these is a real technique attackers use, and stacking them is precisely how a payload becomes illegible. Working through them in sequence is what turns noise back into intent.<\/p>\n

Recovering the code is only half of it. Plaguards then extracts the indicators of compromise buried inside, the domains and IP addresses the script would have contacted, and cross-references them against public threat intelligence through the VirusTotal and Malware Bazaar APIs, checking hashes, IPs, domains, and signatures. The point is to answer the question that actually matters during an incident: is this a valid threat or a false positive. Every analysis is documented in a templated PDF report covering both the deobfuscated output and the IOC findings, which is the unglamorous detail that makes the tool useful in a real IR workflow rather than only at a demo.<\/p>\n

It ships in two forms, a Django-based web application deployed through Docker and a command line interface that takes a .ps1<\/code> or .txt<\/code> payload directly. It is written mostly in Python, released under the AGPLv3, developed by the BAY Cyber Security community, and was presented at Black Hat Arsenal at both Asia and USA in 2025. The project also publishes security advisories about vulnerabilities in certain versions of itself, which is worth reading before deployment and is, quietly, a good sign. A security tool that documents its own weaknesses is behaving the way it asks others to.<\/p>\n

Where This Meets the Curriculum<\/strong><\/p>\n

This is blue team work in its purest form and the natural counterpart to everything the offensive courses teach. Computer Security Fundamental covers malicious software; Plaguards is what confronting it actually looks like. Server and Network Administration builds the log analysis and intrusion detection instincts that surface a suspicious script in the first place, and Computer Forensics supplies the evidence discipline and reporting rigor that make an analysis defensible. For students drawn to SOC analysis, incident response, or malware analysis, deobfuscation is a core skill, and reading how this engine handles each obfuscation technique is a fast way to learn both sides at once. You cannot write a deobfuscator without understanding the obfuscator.<\/p>\n

Explore Plaguards<\/strong><\/p>\n

Repository: github.com\/baycysec\/plaguards<\/a>
\nWiki and setup guides: Plaguards Wiki<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Reading the Script That Was Written to Be Unreadable An incident responder opens a suspicious PowerShell script and finds a wall of nonsense. Strings sliced into fragments and glued back together, base64 nested inside base64, backticks scattered through keywords, characters assembled from arithmetic. None of it is meant to be understood by a human. It […]<\/p>\n","protected":false},"author":706,"featured_media":73113,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,7],"tags":[],"class_list":["post-73112","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-portofolio","category-presence-2025"],"_links":{"self":[{"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/posts\/73112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/users\/706"}],"replies":[{"embeddable":true,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/comments?post=73112"}],"version-history":[{"count":1,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/posts\/73112\/revisions"}],"predecessor-version":[{"id":73114,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/posts\/73112\/revisions\/73114"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/media\/73113"}],"wp:attachment":[{"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/media?parent=73112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/categories?post=73112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/socs.binus.ac.id\/cyber-security\/wp-json\/wp\/v2\/tags?post=73112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}