suspicious-powershell-hunt-cross-platform-ideas

id	hunting.suspicious-powershell-hunt
name	Suspicious PowerShell hunt (cross-platform ideas)
description	Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.
version	0.1.0
author	awesome-dfir-skills contributors
license	Apache-2.0
tags	["powershell","hunting","lolbas","defense-evasion"]
category	hunting
platforms	["windows","any"]
inputs	[{"name":"telemetry_stack","description":"What you want to query (EDR, Sysmon, Windows Event Logs, MDE, Splunk, Sentinel, Elastic).","required":true},{"name":"time_window","description":"Start/end time and timezone.","required":true}]
outputs	[{"name":"hunt_plan","description":"Prioritized hypotheses + what to query + what to pivot to next."},{"name":"query_snippets","description":"Query fragments (generic + some platform-specific)."}]

Suspicious PowerShell hunt (cross-platform ideas)

What this skill does

• Generates a structured hunt plan for PowerShell abuse.
• Focuses on signals that stay useful across tool stacks.

When to use

• You suspect downloader/execution via PowerShell.
• You’re responding to alerts like “EncodedCommand”, “IEX”, “FromBase64String”.

Safety / privacy notes

• Don’t paste full script blocks from production unless permitted.
• Prefer hashing script blocks or sharing key substrings.

Skill instructions

Role: You are a detection engineer / threat hunter.

Task: Build a PowerShell abuse hunt plan for the given environment and time window.

Telem stack: {{telemetry_stack}}

Time window: {{time_window}}

Deliverables:

1. Top hypotheses (3–7) for PowerShell abuse in this environment
2. For each: what to query, expected true positives, common false positives, and next pivots
3. Query snippets (generic string/regex and, if possible, one version for the named stack)

Constraints:

• Prefer fields commonly present: process name, parent process, command line, parent command line, user, host, network dest.
• If you propose a platform-specific query, explain field mapping.

Common suspicious patterns (generic)

• -enc / -encodedcommand
• IEX / Invoke-Expression
• FromBase64String
• DownloadString / DownloadFile
• Hidden window: -w hidden
• Bypass: -ExecutionPolicy Bypass
• LOLBIN parents: winword.exe, excel.exe, outlook.exe, mshta.exe, rundll32.exe, wscript.exe, cscript.exe

Pivots

• Process tree around the suspicious PowerShell
• PowerShell downloading things from the internet
• Network connections from that PID (destinations, SNI, URL paths)
• File writes shortly after execution
• Persistence artifacts (scheduled tasks, services, Run keys)