Detecting Suspicious Powershell Execution
FreeProactively hunt for malicious PowerShell activity.
Free · Opens the source repo
What Detecting Suspicious Powershell Execution does
Detecting Suspicious PowerShell Execution is a specialized skill designed for cybersecurity professionals focused on identifying and mitigating threats associated with PowerShell usage in their environments. This skill leverages telemetry from endpoint detection and response (EDR) systems, such as CrowdStrike and Microsoft Defender for Endpoint, alongside security information and event management (SIEM) tools like Splunk and Elastic. By utilizing these data sources, users can effectively hunt for indicators of compromise (IoCs) related to PowerShell execution techniques, including encoded commands, download cradles, and AMSI bypass methods.
The skill is particularly useful during proactive threat hunting initiatives, incident response scenarios, and security assessments. It guides users through a structured workflow that begins with formulating a hypothesis based on threat intelligence and progresses through data collection, anomaly analysis, and validation of findings. This systematic approach enables security teams to correlate suspicious activities with known threat actor tactics, techniques, and procedures (TTPs), ensuring a comprehensive understanding of potential breaches.
In addition to its core functionality, the skill emphasizes the importance of maintaining an up-to-date threat intelligence feed to enhance detection capabilities. Users are encouraged to document their findings and update detection rules, fostering a culture of continuous improvement in threat detection and response strategies. This skill is essential for security analysts, incident responders, and threat hunters who need to stay ahead of evolving threats that exploit PowerShell for malicious purposes.
Overall, Detecting Suspicious PowerShell Execution equips users with the necessary tools and methodologies to identify and respond to PowerShell-based threats effectively, thereby strengthening their organization's security posture.
When to use it
Use this skill when you need to proactively hunt for PowerShell-based threats or respond to alerts indicating suspicious activity.
When not to use it
This skill may not be suitable for environments without adequate EDR or SIEM capabilities, as it relies heavily on these data sources for effective detection.
What you can build with it
Hunting for Encoded Commands
Use this skill to detect Base64 encoded PowerShell commands that may be launched from malicious documents.
Incident Response for PowerShell Attacks
Employ the skill during incident response to investigate alerts triggered by suspicious PowerShell executions.
Periodic Security Assessments
Incorporate this skill into regular security assessments to evaluate the effectiveness of existing detection measures.
How to install Detecting Suspicious Powershell Execution
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/detecting-suspicious-powershell-execution --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Detecting Suspicious Powershell Execution
When to Use
- When proactively hunting for indicators of detecting suspicious powershell execution in the environment
- After threat intelligence indicates active campaigns using these techniques
- During incident response to scope compromise related to these techniques
- When EDR or SIEM alerts trigger on related indicators
- During periodic security assessments and purple team exercises
Prerequisites
- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
- SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
- Sysmon deployed with comprehensive configuration
- Windows Security Event Log forwarding enabled
- Threat intelligence feeds for IOC correlation
Workflow
- Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
- Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
- Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
- Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
- Validate Findings: Distinguish true positives from false positives through contextual analysis.
- Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
- Document and Report: Record findings, update detection rules, and recommend response actions.
Key Concepts
| Concept | Description |
|---|---|
| T1059.001 | PowerShell |
| T1059.003 | Windows Command Shell |
| T1562.001 | Disable or Modify Tools |
Tools & Systems
| Tool | Purpose |
|---|---|
| CrowdStrike Falcon | EDR telemetry and threat detection |
| Microsoft Defender for Endpoint | Advanced hunting with KQL |
| Splunk Enterprise | SIEM log analysis with SPL queries |
| Elastic Security | Detection rules and investigation timeline |
| Sysmon | Detailed Windows event monitoring |
| Velociraptor | Endpoint artifact collection and hunting |
| Sigma Rules | Cross-platform detection rule format |
Common Scenarios
- Scenario 1: Base64 encoded PowerShell command launched by macro document
- Scenario 2: IEX download cradle fetching payload from C2 server
- Scenario 3: AMSI bypass via reflection patching before payload execution
- Scenario 4: PowerShell Empire agent communicating with C2
Output Format
Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1059.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]
Frequently asked questions about Detecting Suspicious Powershell Execution
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.