Are malicious scripts in batch files detected by antiviruses?

Question

we have many scripts in shared folders in our IT Department.

Are malicious scripts in batch files detected by antiviruses?

Answer 1

It depends what's in it. If it finds del /F /S /Q C:\* inside a Windows batch file, sure, some AVs might flag it up as suspicious. If it's a byte-for-byte copy of a known malicious script, sure, some AVs might catch it.

In general, batch scripts are too variable in order to write a working malicious script detector that catches new or "custom" malware scripts. You're likely to see the AV catching anything particularly prolific, but almost certainly not anything new or custom.

Don't rely on your AV for protection, even if the sales guy told you it's the best protection money can buy. It's a last line of defence at best, and is usually only good for saving you time by preventing the most basic attacks, giving you the ability to prioritise your resources into dealing with the more targeted attacks.

Answer 2

We can't say that it applies to every anti-virus, but for most of them, yes. Naming a specific anti-virus that you use would help us give you a better answer. Batch files shouldn't be the most significant risk on your list so keep a strong anti-virus and firewall up at all times on your network.

Answer 3

There are a number of options that will have different outcomes depending on the risk profile of the server that contains the scripts. Certainly, AV/AM tools will pick up false positives every now and then with custom coded scripts because they all include PHP heuristics and so on nowadays.

1. Report-only, quarantine off: get the AV/AM to report to your NOC/SIEM or admins when a positive is found; and then adjust the SIEM rules etc for false positives as time goes on.
2. Report and Quarantine: on a high risk server this could be the best approach. Perhaps addressing why you have text based scripts for this high risk solution... It is often hard to find the actual script that the AV/AM has matched to (so you can anti-diff etc) and so don't rely on being able to change your script so that it does not report by the AV/AM.
3. No report, no quarantine: if you are doing blanket AV/AM - there is always the option, if the risk profile of this server is low, to exclude individual files. However, that in itself could make them targets in the future. If you did this; think of other ways of mitigating risk like recording a hash of each file and placing additional controls to look for file changes.

Answer 4

Commonly anti viruses uses virus definition which are viruses signatures from viruses written by malware developer and heuristic analysis. There might be a chance of false positives.

But would not post much threat. A good practice is to update your antivirus and do regular scan.