Cyber Hunting For Anomalous Powershell Execution

Name: Cyber Hunting For Anomalous Powershell Execution
Author: nexuslinkproductions

ASecurity

Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block a

2 stars
0 votes
0 copies
1 view
Added September 10, 2026

toolsgoshellnode

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned September 10, 2026

npx -y skills add nexuslinkproductions/yuri-os --skill cyber-hunting-for-anomalous-powershell-execution --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Cyber Hunting For Anomalous Powershell Execution?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Cyber Hunting For Anomalous Powershell Execution

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/nexuslinkproductions-cyber-hunting-for-anomalous-powershell-execution/badge)](https://www.skillsdirectory.com/skills/nexuslinkproductions-cyber-hunting-for-anomalous-powershell-execution)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: cyber-hunting-for-anomalous-powershell-execution
description: "Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events. The analyst parses Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles. Activates for requests involving PowerShell threat hunting, script block a"
hide: true
---

<!-- GENERATED:YURI-CODEX-SKILL-ADAPTER:v1 -->

# YURI skill adapter

Authoritative source: `.claude/skills/cyber-hunting-for-anomalous-powershell-execution/SKILL.md`

Authoritative source SHA-256: `27164258a94047affff91e6c970256ce5df7cf3d4b0d07d55e3f438445d4f12e`

Source class: `cyber-armed`

Before acting, read the authoritative source file above completely from beginning to end. If the governed source is absent, run `node _SYSTEM/Scripts/skill-recall.mjs --show cyber-hunting-for-anomalous-powershell-execution` and read its complete verified output. Follow that source as the skill body; this adapter is a non-authoritative metadata-and-pointer projection.