{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-detecting-suspic-58bf11",
  "kind": "skill",
  "name": "detecting-suspicious-powershell-execution",
  "description": "Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "threat-hunting",
      "mitre-attack",
      "powershell",
      "execution",
      "t1059",
      "amsi",
      "proactive-detection",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/detecting-suspicious-powershell-execution/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/detecting-suspicious-powershell-execution/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/detecting-suspicious-powershell-execution/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Detecting Suspicious Powershell Execution\n\n## When to Use\n\n- When proactively hunting for indicators of detecting suspicious powershell execution in the environment\n- After threat intelligence indicates active campaigns using these techniques\n- During incident response to scope compromise related to these techniques\n- When EDR or SIEM alerts trigger on related indicators\n- During periodic security assessments and purple team exercises\n\n## Prerequisites\n\n- EDR platform with process and network telemetry (CrowdStrike, MDE, SentinelOne)\n- SIEM with relevant log data ingested (Splunk, Elastic, S",
  "cost": {
    "context_tokens": 690
  }
}