cyber-hunting-for-anomalous-powershell-execution

name	cyber-hunting-for-anomalous-powershell-execution
description	Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block a
hide	true

YURI skill adapter

Authoritative source: .claude/skills/cyber-hunting-for-anomalous-powershell-execution/SKILL.md

Authoritative source SHA-256: 27164258a94047affff91e6c970256ce5df7cf3d4b0d07d55e3f438445d4f12e

Source class: cyber-armed

Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run node _SYSTEM/Scripts/skill-recall.mjs --show cyber-hunting-for-anomalous-powershell-execution and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.