skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-anomalous-powershell-execution

Detect malicious PowerShell activity by parsing Windows Event 4104 script block logs.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#powerShell#evtx#amSI bypass#script block logging#event 4104
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-anomalous-powershell-execution
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-anomalous-powershell-execution
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-anomalous-powershell-execution
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-anomalous-powershell-execution

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml.

What problem does it solve?

Malicious PowerShell activity often hides behind obfuscation, encoded commands, and AMSI bypasses, making it hard for SOC analysts to spot real threats in raw Windows event logs. This Skill parses EVTX files to surface suspicious script blocks, download cradles, and credential dumping attempts with severity scoring.

Core Features & Use Cases

  • Script Block Reassembly: Correlates multi-part Event 4104 records by ScriptBlock ID so large obfuscated scripts are analyzed in full rather than as truncated fragments.
  • Attack Pattern Detection: Flags AMSI bypass attempts, base64-encoded commands, download cradles, credential dumping keywords, and lateral movement commands.
  • Severity Scoring: Produces a structured JSON summary counting suspicious events by category for triage prioritization.
  • Use Case: During incident response on a compromised Windows host, an analyst exports the Microsoft-Windows-PowerShell/Operational log and uses this Skill to identify that an attacker ran an encoded IEX download cradle and attempted an AMSI bypass.

Quick Start

Analyze the exported PowerShell Operational EVTX logs from this host and report any obfuscated commands, AMSI bypass attempts, or download cradles.

Frequently Asked Questions about hunting-for-anomalous-powershell-execution

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect malicious PowerShell commands in Windows event logs?▼

Parse Event ID 4104 (Script Block Logging) from the Microsoft-Windows-PowerShell/Operational log, which records full deobfuscated script text. Scan the reassembled script blocks for encoded commands, download cradles, AMSI bypass patterns, and credential dumping keywords.

What tools parse PowerShell EVTX files for threat hunting?▼

This workflow uses Python 3.8+ with the python-evtx and lxml libraries to extract Event 4104 and 4103 records from EVTX exports. Multi-part script blocks are reassembled using the ScriptBlock ID, MessageNumber, and MessageTotal fields before analysis.

Does script block logging work if it was not enabled before the incident?▼

No. Event 4104 only captures scripts executed while the Group Policy setting Turn on PowerShell Script Block Logging was active. If it was disabled, historical script content cannot be recovered, and you must rely on Module Logging (4103) or process creation events instead.

Why does PowerShell logging miss some attacks?▼

Attackers can blind ETW, patch logging via reflection, downgrade to PowerShell version 2, or host runspaces in System.Management.Automation.dll through C# loaders instead of powershell.exe. A host that suddenly stops emitting 4104 events should itself be treated as suspicious.

How do I reduce false positives when hunting encoded PowerShell commands?▼

Baseline by the initiating parent process and script signing status rather than script length alone. Intune, SCCM, and administrative automation legitimately produce long encoded scripts, so scoring should weight AMSI bypass indicators and download cradles more heavily.

Related Skills

Explore More Software Engineering Skills→
rjonhaasrjonhaas
1

Windows Artifacts (EZ Tools / Autoruns / Event Logs)

Parse Windows forensic artifacts into CSV outputs for DFIR triage.

Community
Advanced
aviskaaraviskaar
6

security-operations

Establish and manage SOC capabilities with SIEM configuration and incident response.

Official
Advanced
balsm-healthbalsm-health
2

hunting-for-webshell-activity

Detect webshell deployments by analyzing process creation, network, and web access logs.

Official
Advanced
brucesongsbrucesongs
60

detection-engineering

Create and validate Sigma rules, YARA signatures, and SIEM queries as code.

Community
Advanced