Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Detecting Suspicious Powershell Execution · mukul975 | DecimalAI

Detecting Suspicious Powershell Execution

SkillScore36Maintained

detecting-suspicious-powershell-execution

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

Securityby mukul975

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

Security & AppSec pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/detecting-suspicious-powershell-execution/SKILL.md

decimalai skills pull detecting-suspicious-powershell-execution --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/detecting-suspicious-powershell-execution/SKILL.md https://app.decimal.ai/s/detecting-suspicious-powershell-execution/SKILL.md

Raw file: /s/detecting-suspicious-powershell-execution/SKILL.md ↗ · machine-readable summary at /s/detecting-suspicious-powershell-execution.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

25 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 55d ago

Yes — +32% lift+14% tokens0% turns36% of whole cases pass with skill (9/25)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-13	✗→✓	▲ Improved	—	—
case-21	✗→✓	▲ Improved	—	—
case-10	✗→✓	▲ Improved	—	—
case-03	✗→✓	▲ Improved	—	—
case-07	✗→✓	▲ Improved	—	—

Showing 5 of 25 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 7/30/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

mukul975 / Anthropic-Cybersecurity-Skills

skills/detecting-suspicious-powershell-execution/SKILL.md

View on GitHub ↗

License Apache-2.0Imported 8/8/2026Version v1Bundled 6 files · scripts

Skill contents

scripts/

references/

assets/

SKILL.md

Detecting Suspicious Powershell Execution

When to Use

When proactively hunting for indicators of detecting suspicious powershell execution in the environment
After threat intelligence indicates active campaigns using these techniques
During incident response to scope compromise related to these techniques
When EDR or SIEM alerts trigger on related indicators
During periodic security assessments and purple team exercises

Prerequisites

EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)
SIEM with relevant log data ingested (Splunk, Elastic, Sentinel)
Sysmon deployed with comprehensive configuration
Windows Security Event Log forwarding enabled
Threat intelligence feeds for IOC correlation

Workflow

Formulate Hypothesis: Define a testable hypothesis based on threat intelligence or ATT&CK gap analysis.
Identify Data Sources: Determine which logs and telemetry are needed to validate or refute the hypothesis.
Execute Queries: Run detection queries against SIEM and EDR platforms to collect relevant events.
Analyze Results: Examine query results for anomalies, correlating across multiple data sources.
Validate Findings: Distinguish true positives from false positives through contextual analysis.
Correlate Activity: Link findings to broader attack chains and threat actor TTPs.
Document and Report: Record findings, update detection rules, and recommend response actions.

Key Concepts

| Concept | Description | |---------|-------------| | T1059.001 | PowerShell | | T1059.003 | Windows Command Shell | | T1562.001 | Disable or Modify Tools |

Tools & Systems

| Tool | Purpose | |------|---------| | CrowdStrike Falcon | EDR telemetry and threat detection | | Microsoft Defender for Endpoint | Advanced hunting with KQL | | Splunk Enterprise | SIEM log analysis with SPL queries | | Elastic Security | Detection rules and investigation timeline | | Sysmon | Detailed Windows event monitoring | | Velociraptor | Endpoint artifact collection and hunting | | Sigma Rules | Cross-platform detection rule format |

Common Scenarios

Scenario 1: Base64 encoded PowerShell command launched by macro document
Scenario 2: IEX download cradle fetching payload from C2 server
Scenario 3: AMSI bypass via reflection patching before payload execution
Scenario 4: PowerShell Empire agent communicating with C2

Output Format

Hunt ID: TH-DETECT-[DATE]-[SEQ]
Technique: T1059.001
Host: [Hostname]
User: [Account context]
Evidence: [Log entries, process trees, network data]
Risk Level: [Critical/High/Medium/Low]
Confidence: [High/Medium/Low]
Recommended Action: [Containment, investigation, monitoring]

Illustrative Want to see what detecting-suspicious-powershell-execution would put in front of your model? Preview the rendered body and check its trigger phrases — no LLM call, no signup.

Latest benchmark · publisher runVerified

7/28/2026, 02:24 UTC · 25 cases

Lift

+32%

36% vs 4%

Agent turns

1.0 vs 1.0

Tokens

+14%

2,002.12 vs 1,752.4

fail → pass · 8pass → pass · 1fail → fail · 16

Per-case results (25)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-11 When analyzing threat telemetry where powershell.exe is spawned from cmd.exe command lines, what specific MITRE ATT&CK technique code represents the Windows Command Shell parent process?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-13 After running SIEM and EDR queries to collect raw process events during a PowerShell hunt, what immediate step must be conducted before validating findings for false positives?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-04 We need to set up telemetry on our Linux server pool running Ubuntu 22.04 LTS. Please provide auditd configuration rules to monitor suspicious bash script executions and privilege escalation commands in /etc/audit/rules.d/audit.rules.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-17 An automated detection script output 'Risk Level: 9/10' for an encoded PowerShell payload execution on host APPSRV-01. Rewrite this record key using standard text risk categories.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-14 Which standardized cross-platform detection rule format allows writing platform-neutral SIEM rules for detecting suspicious PowerShell command lines across Splunk, Elastic, and Defender?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-08 During analysis of process memory logs on host SEC-OPS-01, an analyst noted reflective memory patching targeting AmsiScanBuffer. Which MITRE ATT&CK technique code corresponds to disabling or modifying security tools in this context?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-15 Which endpoint artifact collection and hunting tool is designed for deep endpoint artifact gathering and hunting across distributed hosts?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-21 What is the concluding phase of the threat hunting workflow after activity correlation and attack chain linking are completed?	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-10 Network logs show periodic HTTP requests from powershell.exe on host FIN-DB-01 to an external IP associated with a PowerShell Empire framework. Produce the threat hunt findings report.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-18 An analyst submitted a hunt finding report listing 'Confidence: 85%'. Correct this field value to fit standard confidence qualitative ratings.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-25 Security logs show a PowerShell session loading a script that modifies AMSI memory buffers before executing an obfuscated payload. What recommended action should be taken for the compromised host?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-03 During a purple team exercise, security logs flagged potential AMSI bypass attempt via memory reflection patching on PC-EXEC-11. Conduct a threat hunting analysis for suspicious PowerShell execution on this system and provide a summary output specifying the Hunt ID, ATT&CK technique, host, user account, event evidence, risk level, confidence, and recommended action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-05 Our AppSec scanner flagged a SQL injection vulnerability in our Flask API route that queries user accounts using string concatenation. Please provide the remediated Python code using parameterized SQL queries with SQLAlchemy.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-19 To capture granular PowerShell execution logs including script block logging and process creation on Windows hosts, which Windows Security log forwarding and telemetry tool configurations are required?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-07 An alert generated on endpoint WS-HR-12 showed winword.exe spawning cmd.exe which executed a powershell -EncodedCommand string. Format the findings using your standard threat hunting report format.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-24 Which SIEM platform utilizes Search Processing Language (SPL) queries for log analysis during threat hunting?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-09 Endpoint telemetry from host DEV-WRK-09 indicates powershell.exe invoked Net.WebClient DownloadString inside an Invoke-Expression function call. Generate the threat hunting record for this activity.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-12 In a structured threat hunting framework for endpoint execution anomalies, what is the initial step before data source identification or running queries?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-01 Our EDR platform raised an alert for an Office document spawning a command shell that launched an encoded PowerShell command on workstation WS-FIN-04. Please investigate this incident and report the results listing a unique Hunt ID, the relevant MITRE technique, host name, account context, supporting evidence from process trees or logs, evaluated risk level, confidence rating, and recommended response action.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-23 In an enterprise security stack, which platform provides process and network telemetry EDR capabilities specifically paired with Falcon threat detection?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-16 A tier-1 analyst logged a threat hunt record but used 'Host Name:' and 'Risk:' instead of standard report headers for host HOST-01. Report the corrected standard output block structure for host HOST-01.	pass→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-22 Which Microsoft EDR tool uses Kusto Query Language (KQL) for advanced hunting of PowerShell execution events?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-20 An analyst is triaging an Excel document that launched powershell.exe with hidden window parameters. What risk level classification is appropriate for macro-launched hidden PowerShell execution?	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—
case-02 We observed host SRV-APP-02 executing a script that appears to be an Invoke-Expression download cradle pulling remote code. Please analyze our SIEM telemetry to confirm whether this is malicious PowerShell activity and summarize your analysis detailing a tracking Hunt ID, technique ID, host, user context, key evidence, risk score, confidence, and recommended containment steps.	fail→pass	—	—	—	—	—	—	—	—	—	—	—	—
case-06 We noticed anomalous object downloads from an S3 bucket in AWS. Please explain how to configure AWS GuardDuty alert filtering and CloudTrail Lake SQL queries to identify the IAM entity responsible for unauthorized S3 GET requests.	fail→fail	—	—	—	—	—	—	—	—	—	—	—	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 25 cases were attempted. The headline lift of +32 percentage points is the difference between those two pass rates over the 25 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 4%
Pass rate with the skill: 36%
Cases attempted: 25
Cases counted toward lift: 25
Cases that regressed: 0
Skill version measured: v1
Run completed: 7/28/2026, 02:24 UTC

The per-case answers from this run were removed by the retention sweep, so the case table below shows the verdicts without the text either arm produced. The counts above were recorded at the time and are unaffected. Answers are now kept for 180 days.

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run36

Live evalNeeds ≥10 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+2% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 55 days ago

Other measured skills in the registry, with their headline benchmark lift.

Ready to supercharge your AI agents?

Detecting Suspicious Powershell Execution

SkillSafety

Source

Detecting Suspicious Powershell Execution

When to Use

Prerequisites

Workflow

Key Concepts

Tools & Systems

Common Scenarios

Output Format

How this skill was measured

Related skills