Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-anomalous-powershell-executionnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-anomalous-powershell-execution -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill hunting-for-anomalous-powershell-execution -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/hunting-for-anomalous-powershell-executiongh skill install mukul975/Anthropic-Cybersecurity-Skills hunting-for-anomalous-powershell-executiongit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-anomalous-powershell-execution ~/.claude/skills/hunting-for-anomalous-powershell-execution # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/hunting-for-anomalous-powershell-execution ~/.agents/skills/hunting-for-anomalous-powershell-execution # Codex, Cursor, Gemini CLI, Copilot, OpenCode