Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block a
Scanned 9/10/2026
Install to Claude Code
Skills Directorynpx -y skills add nexuslinkproductions/yuri-os --skill cyber-hunting-for-anomalous-powershell-execution --agent claude-codeInstalls into .claude/skills of the current project.
Are you the author of Cyber Hunting For Anomalous Powershell Execution?
Add the live security badge to your README — it updates automatically with every re-scan.
[](https://www.skillsdirectory.com/skills/nexuslinkproductions-cyber-hunting-for-anomalous-powershell-execution)More formats (shields.io, HTML) on the badges page.
---
name: cyber-hunting-for-anomalous-powershell-execution
description: "Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block a"
hide: true
---
<!-- GENERATED:YURI-CODEX-SKILL-ADAPTER:v1 -->
# YURI skill adapter
Authoritative source: `.claude/skills/cyber-hunting-for-anomalous-powershell-execution/SKILL.md`
Authoritative source SHA-256: `27164258a94047affff91e6c970256ce5df7cf3d4b0d07d55e3f438445d4f12e`
Source class: `cyber-armed`
Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run `node _SYSTEM/Scripts/skill-recall.mjs --show cyber-hunting-for-anomalous-powershell-execution` and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.
Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.
No comments yet. Be the first to comment!
