Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-powershell-executionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-powershell-execution -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-suspicious-powershell-execution -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/detecting-suspicious-powershell-executiongh skill install mukul975/Anthropic-Cybersecurity-Skills detecting-suspicious-powershell-executiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-suspicious-powershell-execution ~/.claude/skills/detecting-suspicious-powershell-execution # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/detecting-suspicious-powershell-execution ~/.agents/skills/detecting-suspicious-powershell-execution # Codex, Cursor, Gemini CLI, Copilot, OpenCode