id	hunting.suspicious-powershell-hunt
name	Suspicious PowerShell hunt (cross-platform ideas)
description	Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.
version	0.1.0
author	awesome-dfir-skills contributors
license	Apache-2.0
tags	["powershell","hunting","lolbas","defense-evasion"]
category	hunting
platforms	["windows","any"]
inputs	[{"name":"telemetry_stack","description":"What you want to query (EDR, Sysmon, Windows Event Logs, MDE, Splunk, Sentinel, Elastic).","required":true},{"name":"time_window","description":"Start/end time and timezone.","required":true}]
outputs	[{"name":"hunt_plan","description":"Prioritized hypotheses + what to query + what to pivot to next."},{"name":"query_snippets","description":"Query fragments (generic + some platform-specific)."}]

Suspicious PowerShell hunt (cross-platform ideas)

What this skill does

Generates a structured hunt plan for PowerShell abuse.
Focuses on signals that stay useful across tool stacks.

When to use

You suspect downloader/execution via PowerShell.
You’re responding to alerts like “EncodedCommand”, “IEX”, “FromBase64String”.

Safety / privacy notes

Don’t paste full script blocks from production unless permitted.
Prefer hashing script blocks or sharing key substrings.

Skill instructions

Role: You are a detection engineer / threat hunter.

Task: Build a PowerShell abuse hunt plan for the given environment and time window.

Telem stack: {{telemetry_stack}}

Time window: {{time_window}}

Deliverables:

Top hypotheses (3–7) for PowerShell abuse in this environment

For each: what to query, expected true positives, common false positives, and next pivots

Query snippets (generic string/regex and, if possible, one version for the named stack)

Constraints:

Prefer fields commonly present: process name, parent process, command line, parent command line, user, host, network dest.

If you propose a platform-specific query, explain field mapping.

Common suspicious patterns (generic)

-enc / -encodedcommand
IEX / Invoke-Expression
FromBase64String
DownloadString / DownloadFile
Hidden window: -w hidden
Bypass: -ExecutionPolicy Bypass
LOLBIN parents: winword.exe, excel.exe, outlook.exe, mshta.exe, rundll32.exe, wscript.exe, cscript.exe

Pivots

Process tree around the suspicious PowerShell
PowerShell downloading things from the internet
Network connections from that PID (destinations, SNI, URL paths)
File writes shortly after execution
Persistence artifacts (scheduled tasks, services, Run keys)

Más de este repositorio

mismo repositorio

admiralty-system

tsale/awesome-dfir-skills

Apply the NATO Admiralty System (AJP-2.1) to assess source reliability and information credibility in cyber threat intelligence, OSINT, and breach analysis. Use this skill whenever you need to evaluate a CTI report, breach claim, dark web forum post, threat actor advertisement, vendor blog, social media intel claim, leaked database listing, or any source plus information pair where trust matters. Trigger phrases include "assess this source", "rate this report", "is this breach real", "evaluate credibility", "source assessment", "should I trust this claim", "admiralty rating", "A1 to F6", and any review of CTI or OSINT material where you need to decide how much weight to give it. Use proactively when the user shares a breach post, threat actor claim, or vendor report and asks for analysis, even if they do not explicitly mention the Admiralty System. Also use when teaching, building courseware, or producing a training example around source evaluation.

2026-05-14321

threat-actor-profiling

tsale/awesome-dfir-skills

Build structured threat actor profiles using the 5W1H framework and the Diamond Model. Use this skill whenever the user wants to profile a threat actor, create a TA report, analyze an APT group, build an adversary profile, assess threat actor capability, map TTPs to MITRE ATT&CK for a specific group, or produce any intelligence deliverable about a threat actor. Also trigger when the user mentions threat actor names (e.g. APT29, Lazarus, FIN7), asks about victimology, modus operandi, or wants to structure threat intelligence around an adversary. This skill applies to both internal tracking profiles and incident-driven analytical deliverables.

2026-04-10321

osquery-query-helper

tsale/awesome-dfir-skills

Help users write, validate, and troubleshoot osquery SQL queries using provided osquery table schemas as the authoritative source.

2026-02-03321

malware-analysis

tsale/awesome-dfir-skills

Professional malware analysis workflow for PE executables and suspicious files. Triggers on file uploads with requests like "analyze this malware", "analyze this sample", "what does this executable do", "check this file for malware", or any request to examine suspicious files. Performs static analysis, threat intelligence triage, behavioral inference, and produces analyst-grade reports with reasoned conclusions.

2026-01-21321

analysing-attack

tsale/awesome-dfir-skills

Analyse Mitre ATT&CK tactics, techniques and sub-techniques. Use when performing analysis of threat detections, threat models, security risks or cyber threat intelligence

2026-01-08321

windows-intrusion-timeline-targeted

tsale/awesome-dfir-skills

Create a targeted intrusion timeline for a Windows incident using whatever artifacts are available (event logs, EDR, SIEM exports, triage notes).

2025-12-27321

Suspicious PowerShell hunt (cross-platform ideas)

What this skill does

Generates a structured hunt plan for PowerShell abuse.

Focuses on signals that stay useful across tool stacks.

When to use

You suspect downloader/execution via PowerShell.

You’re responding to alerts like “EncodedCommand”, “IEX”, “FromBase64String”.

Safety / privacy notes

Don’t paste full script blocks from production unless permitted.

Prefer hashing script blocks or sharing key substrings.

Skill instructions

Role: You are a detection engineer / threat hunter.

Task: Build a PowerShell abuse hunt plan for the given environment and time window.

Telem stack: {{telemetry_stack}}

Time window: {{time_window}}

Deliverables:

Top hypotheses (3–7) for PowerShell abuse in this environment
For each: what to query, expected true positives, common false positives, and next pivots
Query snippets (generic string/regex and, if possible, one version for the named stack)

Constraints:

Prefer fields commonly present: process name, parent process, command line, parent command line, user, host, network dest.
If you propose a platform-specific query, explain field mapping.

Common suspicious patterns (generic)

-enc / -encodedcommand

IEX / Invoke-Expression

FromBase64String

DownloadString / DownloadFile

Hidden window: -w hidden

Bypass: -ExecutionPolicy Bypass

LOLBIN parents: winword.exe, excel.exe, outlook.exe, mshta.exe, rundll32.exe, wscript.exe, cscript.exe

Pivots

Process tree around the suspicious PowerShell

PowerShell downloading things from the internet

Network connections from that PID (destinations, SNI, URL paths)

File writes shortly after execution

Persistence artifacts (scheduled tasks, services, Run keys)