How PowerShell Gallery simplifies attacks
Installation automation in the tool presents threat actors with one key link in the kill chain of a possible supply chain attack.
Recursive Unpacking
What is recursive unpacking?
Recursive unpacking is the process of extracting and analyzing nested files, archives, and compressed containers within a software artifact to reveal all embedded components. It’s essential for identifying deeply buried code, dependencies, or threats that are not visible through surface-level inspection.
Why is recursive unpacking critical?
Threat actors often hide malware or unauthorized files within multi-layered packaging formats (e.g., ZIP files within JAR files within EXE files). Without recursive unpacking, security tools may overlook critical payloads or vulnerable components embedded deep within software artifacts, especially in compiled or packaged releases.
How it works
A recursive unpacking engine:
- Detects compressed or embedded file structures (e.g., TAR, JAR, MSI, ELF sections)
- Extracts each layer iteratively until all subfiles are exposed
- Applies static and/or dynamic analysis to each extracted layer
- Rebuilds file trees and component relationships to support software bill of materials (SBOM) generation or threat analysis
It’s used in conjunction with binary analysis tools, malware detection engines, and Software Bill of Materials (SBOM) extractors.
Benefits
- Improves Malware Detection by exposing hidden threats in layered files
- Supports Complete SBOM Generation by revealing all embedded components
- Enhances Third-Party Software Auditing with deeper visibility
- Strengthens Software Integrity Checksfor compliance and trustworthiness
Recursive unpacking vs
Topic | Focus Area | Key Differences |
|---|---|---|
Binary SBOM | List of components in compiled code | Recursive unpacking helps generate accurate binary SBOMs |
Post-Compilation Scanning | Scans compiled artifacts | Recursive unpacking is often a prerequisite for effective scanning |
Artifact Behavioral Analysis | Runtime execution analysis | Focuses on behavior, not file structure or embedded content |
Recursive unpacking best practices
- Automatically unpack all file layers before analysis or deployment
- Identify hidden components or tools not declared in the source SBOM
- Detect mismatches between declared and actual shipped components
- Use unpacking output to feed into static, dynamic, or behavioral scanners
Use cases
- Deep Malware Hunting: Discovering payloads embedded in signed or compressed files
- Software Assurance for Enterprises: Unpacking vendor-delivered software to verify integrity
- Binary Transparency Audits:Validating what's inside release candidates before signing
Additional considerations
- Requires format-awareness and support for nested and obfuscated archives
- Should be tightly integrated with SBOM tools and malware analysis platforms
- Needs strong error handling for corrupted or malicious containers
- Plays a critical role in the software supply chain and DevSecOps workflows
