Hunting for Anomalous PowerShell Execution
FreeDetect malicious PowerShell activity through event log analysis.
Free · Opens the source repo
What Hunting for Anomalous PowerShell Execution does
This skill is designed for security analysts who need to hunt for malicious PowerShell activity by analyzing Windows Event Logs, specifically focusing on Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). By leveraging these logs, the skill enables users to detect a variety of suspicious activities, including encoded commands, AMSI bypass attempts, and credential dumping keywords. The analysis is crucial for identifying fileless attack techniques and obfuscation layers that attackers often employ to evade detection.
The skill operates by parsing EVTX files that contain PowerShell operational logs. It extracts relevant script block text and metadata, reassembles multi-part script blocks, and scans for indicators of compromise such as obfuscation patterns and AMSI bypass attempts. This structured approach helps analysts prioritize findings based on threat severity, allowing for efficient incident response and threat hunting.
With the increasing prevalence of PowerShell as a tool for attackers, this skill is particularly valuable in environments where PowerShell is widely used. It provides a systematic method for validating security monitoring coverage and building detection rules tailored to PowerShell threats. By utilizing this skill, organizations can enhance their threat detection capabilities and respond more effectively to potential security incidents.
In summary, this skill is essential for any security operations center (SOC) analyst tasked with investigating PowerShell-related threats, providing them with the tools needed to analyze and interpret complex event logs effectively.
When to use it
Use this skill when investigating security incidents involving PowerShell or when developing detection rules for PowerShell threats.
When not to use it
This skill is not suitable for environments where PowerShell is not used or for general-purpose log analysis unrelated to PowerShell.
What you can build with it
Investigating a Security Incident
Use this skill to analyze PowerShell logs when a potential security breach is suspected, helping to identify malicious activity.
Building Detection Rules
Leverage this skill to create tailored detection rules for monitoring PowerShell threats in your security infrastructure.
Validating Security Coverage
Apply this skill to assess and validate your organization's security monitoring coverage against PowerShell attack techniques.
How to install Hunting for Anomalous PowerShell Execution
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-anomalous-powershell-execution --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for Anomalous PowerShell Execution
Overview
PowerShell Script Block Logging (Event ID 4104) records the full deobfuscated script text executed on a Windows endpoint, making it the primary data source for hunting malicious PowerShell. Combined with Module Logging (4103) and process creation events, analysts can detect encoded commands, AMSI bypass patterns, download cradles, credential theft tools, and fileless attack techniques even when the attacker uses obfuscation layers.
When to Use
- When investigating security incidents that require hunting for anomalous powershell execution
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Windows Event Log exports (.evtx) from Microsoft-Windows-PowerShell/Operational
- Python 3.8+ with python-evtx and lxml libraries
- Script Block Logging enabled via Group Policy
- Understanding of common PowerShell attack techniques
Steps
- Parse EVTX files extracting Event 4104 script block text and metadata
- Reassemble multi-part script blocks using ScriptBlock ID correlation
- Scan script text for AMSI bypass indicators and obfuscation patterns
- Detect encoded command execution and base64 payloads
- Identify download cradles, credential dumping, and lateral movement commands
- Score and prioritize findings by threat severity
Expected Output
{
"total_events": 1247,
"suspicious_events": 23,
"amsi_bypass_attempts": 2,
"encoded_commands": 8,
"download_cradles": 5,
"credential_access": 3
}
Frequently asked questions about Hunting for Anomalous PowerShell Execution
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.