skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

deobfuscating-powershell-obfuscated-malware

Deobfuscate multi-layer PowerShell malware using AST analysis, IEX replacement, and IOC extraction.

954|172|Updated Mar 13, 2026
Search Tags:#incident response#deobfuscation#powerShell#malware analysis#ast analysis#IOC extraction#base64 decoding
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill deobfuscating-powershell-obfuscated-malware
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: deobfuscating-powershell-obfuscated-malware
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/malware-analysis/deobfuscating-powershell-obfuscated-malware
Command: npx skills add https://github.com/xalgord/xalgorix --skill deobfuscating-powershell-obfuscated-malware

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

PowerShell malware hides behind stacked obfuscation layers like Base64 encoding, tick-mark insertion, string concatenation, and Invoke-Expression chaining, making manual analysis slow and error-prone. This Skill provides a systematic workflow to peel each layer, reveal the final payload, and extract indicators of compromise.

Core Features & Use Cases

  • Obfuscation Classification: Automatically identify techniques such as EncodedCommand, FromBase64String, char arrays, XOR loops, SecureString abuse, and compression streams.
  • Multi-Layer Deobfuscation: Iteratively replace IEX with Write-Output and decode Base64 UTF-16LE blobs until the final stage is exposed, using PSDecode, PowerDecode, or AST-based analysis.
  • IOC Extraction: Pull URLs, IPs, file paths, registry keys, and suspicious commands from the deobfuscated script for detection engineering.
  • Use Case: An incident responder receives a phishing email with an obfuscated PowerShell dropper. Use this Skill to decode each layer in an isolated VM, recover the C2 URL and payload path, and validate findings against Sysmon and Script Block Logging telemetry.

Quick Start

Deobfuscate the attached obfuscated PowerShell script, identify each obfuscation layer, and extract all URLs, IPs, and file paths from the final payload.

Frequently Asked Questions about deobfuscating-powershell-obfuscated-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deobfuscate an obfuscated PowerShell script?▼

Start by classifying the obfuscation layers: Base64 EncodedCommand, tick-mark insertion, string concatenation, or XOR loops. Decode Base64 as UTF-16LE, strip non-escape backticks, then iteratively replace Invoke-Expression with Write-Output in an isolated VM until the final payload appears.

What tools are used for PowerShell malware deobfuscation?▼

PSDecode and PowerDecode automate multi-layer deobfuscation, while PowerPeeler performs instruction-level AST analysis with a reported 95% correctness rate. CyberChef handles manual encoding transformations, and custom Python scripts classify techniques and extract IOCs.

Why does decoding one Base64 layer not reveal the payload?▼

Modern malware stacks multiple layers, so a decoded EncodedCommand often contains another FromBase64String blob, GZip or Deflate compression, or a -bxor loop. Re-classify each decoded output and keep peeling until no further encoding indicators remain.

Can IEX replacement miss parts of the malicious script?▼

Yes, swapping IEX for Write-Output misses other execution sinks such as the & and . invocation operators, .Invoke(), [scriptblock]::Create(), runspaces, and Start-Process hand-offs. Grep for every execution sink, not just IEX or Invoke-Expression.

How do I safely execute obfuscated PowerShell for analysis?▼

Detonate only in an isolated VM with Script Block Logging and Sysmon enabled, since samples may patch AmsiScanBuffer or ETW to hide the deobfuscated stage. Diff the captured final stage against your static decode and verify extracted URLs and paths against observed behavior.

How do I avoid false positives with encoded PowerShell commands?▼

Legitimate installers, EDR agents, and DSC automation also use -EncodedCommand and compression, so encoding presence alone is not malicious. Judge on decoded intent such as download-and-execute patterns, AMSI tampering, or Defender exclusion changes.

Related Skills

Explore More Software Engineering Skills→
GhostPWNGhostPWN
4

Malware Analysis & Sandboxing

Extract hashes, strings, imports, and entropy from suspicious binaries.

Official
Advanced
dandyedandye
120

hunt-ioc

Parse IOC lists, query SIEMs, and enrich matched indicators.

Community
Advanced
DexterJieDexterJie

ctf-malware

Analyze malware and network traffic in CTF challenges.

Community
Advanced
zhizhuodemaozhizhuodemao
402

ast-deobfuscate

Deobfuscate JavaScript code using a Babel-based AST transformation pipeline.

Community
Advanced