'powershell' 검색 결과

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Check shell commands before they run and warn about destructive actions such as file deletion, database removal, and Git history changes. Users can approve ordinary warnings, while certain catastrophic command patterns are denied.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check destructive commands in production
• Review deletion commands in shared environments
• Catch Git operations that discard work

Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating executable files and libraries
• Tracing processing from strings and function calls
• Organizing analysis with comments and meaningful names

Convert Simplicité text logs into structured JSON while keeping only the fields needed for troubleshooting. Preserve multiline errors and stack traces, and reduce the amount of log content passed to an AI agent for analysis.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing large logs for AI analysis
• Extracting timestamps, severity levels, and messages
• Preserving multiline errors during conversion

Create and update prompt-based agents in Azure AI Foundry from a local JSON manifest, a file listing agent definitions. The skill prepares synchronization scripts, pushes instructions to the service, and verifies registered agents.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Registering multiple agents from JSON definitions
• Synchronizing changes to agent instructions
• Preparing a manifest and synchronization script

Create an agent user in Microsoft Entra ID so an AI agent can access services requiring a user identity. Covers validating the parent agent identity, creating the account, assigning a manager and licenses, and troubleshooting setup errors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create a user identity linked to an existing agent identity
• Prepare an agent account for a mailbox and Teams
• Assign a manager for organizational chart visibility

Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing storage settings across Azure subscriptions
• Investigating publicly accessible blob containers
• Verifying encryption, network, and logging controls

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Use when writing or running PowerShell on Windows, especially native programs, quoted paths, escaping, pwsh, Start-Process, file operations, or shell troubleshooting.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AAD アプリ登録を行わずに、Microsoft Graph API 経由で SharePoint を包括的に操作する。リスト（ドキュメントライブラリ）・列・リスト項目の作成、ファイルアップロード、ページ作成、M365 グループ経由のサイト作成に対応。Microsoft Graph PowerShell の well-known パブリッククライアントで委任認証し、auth_helper.py のキャッシュを再利用する。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. Activates for requests to hunt fileless malware, detect in-memory execution, or find registry-resident and reflective-loading activity.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Creates and reviews agent skills safely by enforcing deletion-prevention harness rules: no fixed absolute temp paths, no cwd-dependent cleanup, no wildcard deletes, no workspace-external file operations, no silent cleanup failures, and mandatory temp-root validation before any destructive command. Use when creating a new skill, updating an existing SKILL.md, or reviewing prompts/runbooks that include temp files, extraction, cleanup, PowerShell, bash, rm, del, Remove-Item, or archive expansion.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.