Plugins
1 pluginResults for “cra”
3 skillsMore results
Detecting Suspicious Powershell Execution
Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.
24.6k · bundle
Hunting For Anomalous Powershell Execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events from Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles.
24.6k · bundle