# Suspicious PowerShell hunt (cross-platform ideas)

> Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.

- Skill: `tsale/suspicious-powershell-hunt-cross-platform-ideas` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tsale/suspicious-powershell-hunt-cross-platform-ideas`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tsale/suspicious-powershell-hunt-cross-platform-ideas/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: Apache-2.0
- Author: tsale (https://skillmd.com/u/tsale)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tsale/suspicious-powershell-hunt-cross-platform-ideas

---


# Suspicious PowerShell hunt (cross-platform ideas)

## What this skill does

- Generates a structured hunt plan for PowerShell abuse.
- Focuses on signals that stay useful across tool stacks.

## When to use

- You suspect downloader/execution via PowerShell.
- You’re responding to alerts like “EncodedCommand”, “IEX”, “FromBase64String”.

## Safety / privacy notes

- Don’t paste full script blocks from production unless permitted.
- Prefer hashing script blocks or sharing key substrings.

## Skill instructions

> **Role**: You are a detection engineer / threat hunter.
>
> **Task**: Build a PowerShell abuse hunt plan for the given environment and time window.
>
> **Telem stack**:
> {{telemetry_stack}}
>
> **Time window**:
> {{time_window}}
>
> **Deliverables**:
> 1) **Top hypotheses** (3–7) for PowerShell abuse in this environment
> 2) For each: **what to query**, **expected true positives**, **common false positives**, and **next pivots**
> 3) **Query snippets** (generic string/regex and, if possible, one version for the named stack)
>
> **Constraints**:
> - Prefer fields commonly present: process name, parent process, command line, parent command line, user, host, network dest.
> - If you propose a platform-specific query, explain field mapping.

## Common suspicious patterns (generic)

- `-enc` / `-encodedcommand`
- `IEX` / `Invoke-Expression`
- `FromBase64String`
- `DownloadString` / `DownloadFile`
- Hidden window: `-w hidden`
- Bypass: `-ExecutionPolicy Bypass`
- LOLBIN parents: `winword.exe`, `excel.exe`, `outlook.exe`, `mshta.exe`, `rundll32.exe`, `wscript.exe`, `cscript.exe`

## Pivots

- Process tree around the suspicious PowerShell
- PowerShell downloading things from the internet
- Network connections from that PID (destinations, SNI, URL paths)
- File writes shortly after execution
- Persistence artifacts (scheduled tasks, services, Run keys)