skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-suspicious-powershell-execution

Detects suspicious PowerShell execution including encoded commands, download cradles, and AMSI bypass attempts.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#siem#powerShell#mitre attack#amSI bypass#t1059
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-suspicious-powershell-execution
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-suspicious-powershell-execution
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/detecting-suspicious-powershell-execution
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-suspicious-powershell-execution

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams struggle to spot malicious PowerShell activity because attackers use obfuscation, encoded commands, and LOLBin proxies that evade naive detection rules. This Skill provides a structured threat-hunting workflow with concrete detection logic, gap analysis, and validation steps for identifying suspicious PowerShell execution.

Core Features & Use Cases

  • Detection Gap Analysis: Identifies blind spots such as missing Script Block Logging (EID 4104), encoded command aliases, AMSI patching, and PowerShell downgrade attacks.
  • Structured Hunt Workflow: Guides analysts through hypothesis formulation, data source identification, SIEM/EDR query execution, and false-positive tuning.
  • Validation with Atomic Red Team: Recommends running T1059.001 tests to confirm detections fire on encoded commands and download cradles.
  • Use Case: During a purple team exercise, an analyst uses this Skill to hunt for IEX download cradles and AMSI bypass attempts across CrowdStrike and Splunk telemetry, then baselines SCCM and Intune activity to reduce false positives.

Quick Start

Hunt for suspicious PowerShell execution on our Windows endpoints, focusing on encoded commands and AMSI bypass indicators from the last 7 days.

Frequently Asked Questions about detecting-suspicious-powershell-execution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect encoded PowerShell commands in my environment?▼

Detect encoded PowerShell commands by matching Sysmon EID 1 events on OriginalFileName PowerShell.EXE combined with base64 entropy analysis, rather than matching the literal powershell.exe -enc string. This catches aliases like -e and -ec, pwsh, and renamed binaries.

What tools are needed for PowerShell threat hunting?▼

PowerShell threat hunting requires an EDR platform such as CrowdStrike, Microsoft Defender for Endpoint, or SentinelOne, plus a SIEM like Splunk, Elastic, or Sentinel. Sysmon with a comprehensive configuration and Windows Security Event Log forwarding are also prerequisites.

Why does Script Block Logging matter for PowerShell detection?▼

Script Block Logging (EID 4104) captures the deobfuscated script content, making it the ground truth for detection. Without it, you only have command-line telemetry from EID 4688 or Sysmon EID 1, which obfuscation easily defeats.

How do attackers bypass AMSI and PowerShell logging?▼

Attackers bypass AMSI using reflection patching such as amsiInitFailed, downgrade to PowerShell version 2, or patch the ETW provider in-process. A host that suddenly stops emitting 4104 events should be treated as suspicious rather than clean.

How do I reduce false positives in PowerShell detection rules?▼

Reduce false positives by baselining legitimate automation from SCCM, Intune, and admin tooling, which commonly generate encoded or lengthy PowerShell. Allowlist by signing certificate and parent processes such as WmiPrvSE or ccmexec before alerting.

How can I validate my PowerShell detection rules actually work?▼

Validate detection rules by running Atomic Red Team tests for T1059.001, covering encoded commands and download cradles. Confirm that your 4104 keyword searches and encoded-command detections fire as expected against the test activity.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
makashmakash
2

pypi-supply-chain-response

Identify compromised PyPI packages and guide six-phase incident response.

Community
Advanced
Happy-Technologies-LLCHappy-Technologies-LLC
34

correlation-insights

Correlate security incidents with events, vulnerabilities, and threat intelligence.

Official
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced