'powershell' 검색 결과

Investigate suspicious PowerShell activity using endpoint monitoring data and security logs. Examine encoded commands, downloads, and attempts to evade inspection, then document evidence, affected systems, risk, and recommended response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Hunting for suspicious PowerShell execution
• Investigating endpoint and security log alerts
• Assessing the scope of a PowerShell-related incident

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Analyze Windows PowerShell event logs to reconstruct scripts split across records and identify encoded commands, suspicious downloads, and security scanning bypass attempts. Produce a report with recovered scripts, risk scores, and mappings to documented attack techniques.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Reconstructing scripts split across log records
• Finding encoded commands and suspicious downloads

Search Windows PowerShell logs for traces of Empire, a framework used after a system is compromised. Identify characteristic launch commands, encoded code, module calls, and communication paths, then report suspicious events with timelines and severity scores.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspected Empire activity
• Checking encoded commands and communication paths
• Building detection rules from Empire indicators

Migrate existing PowerShell Pester tests through major versions from v3 to v6. The skill guides assertion updates, setup restructuring, mock changes, and execution configuration, using before-and-after test results to investigate failures while preserving what each test checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Migrating Pester tests one major version at a time
• Fixing tests broken by a Pester upgrade
• Updating legacy Should and Invoke-Pester syntax

Update Pester test assertions, checks of expected results, from classic v5 syntax to v6 Should-* commands. Identify behavior changes involving booleans, empty values, and collections, then verify the suite and report conversions needing human judgment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Convert assertions in PowerShell test files
• Adopt Should-* syntax one file at a time
• Review boolean, empty-value, and collection checks

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Manage Microsoft 365 setup, bulk user onboarding and offboarding, licenses, and security reviews. Generate PowerShell scripts and setup plans, with workflows for checking inputs, reviewing changes, and validating results before applying them across an organization.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan and configure a new Microsoft 365 environment
• Create user accounts and assign licenses in bulk
• Block departing users and prepare shared mailboxes

Add clear runtime reporting to Python, PowerShell, or Node.js batch scripts. Design start messages, progress counts, item failures, and final summaries while preserving existing result output, error handling, and exit codes, then verify visibility during execution.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Add progress reporting to long-running batch scripts
• Report individual failures and final outcome counts
• Keep progress logs separate from machine-readable results

Verify changes to Office add-in administration scripts using a temporary home directory. It covers syntax checks, cache-clearing behavior, identifier handling, and storage comparisons to check that removing add-in manifests preserves chat history.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Testing cache-clearing changes in a temporary home directory
• Checking that deletion affects only the selected add-in
• Checking that chat history remains after manifest removal

Windows 11 system administration with PowerShell — system info reporting, hardware monitoring, package management (winget/scoop), disk cleanup, performance optimization, environment configuration, PowerShell profile setup with aliases and autocomplete, and Task Scheduler automation. Use when user asks to check system info, install tools on Windows, clean up disk space, set up PowerShell profile, or automate Windows tasks. Do NOT use for Linux administration, cross-platform scripting, or network infrastructure management.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts malicious PowerShell using script-block (EID 4104) and module logging: scoring encoded commands, download cradles, AMSI/logging bypass, and in-memory execution, then decoding payloads for triage. Activates for requests to hunt malicious PowerShell, analyze script-block logs, or detect encoded command abuse.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Deobfuscates malicious PowerShell by decoding -EncodedCommand, reversing string and format obfuscation, resolving base64/gzip/IEX layers, and recovering the final payload and IOCs. Activates for requests to deobfuscate, decode, or analyze obfuscated PowerShell commands or scripts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Work through GitHub pull request feedback by classifying findings, fixing code, running repository checks, and posting replies. With suitable permissions, the skill repeats Copilot reviews until the latest code is reviewed and every thread has an agent response.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Address outstanding Copilot review comments
• Run repeated reviews on a completed pull request
• Explain declined suggestions and hand off design decisions

Audit Microsoft Entra ID identity settings to uncover weak authentication policies, excessive administrator privileges, inactive accounts, and guest access risks. Review conditional access rules and sign-in logs, then organize findings into a prioritized security report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing authentication and administrator access in an Azure tenant
• Assessing identity settings before integrating an acquired tenant
• Finding inactive accounts and privileged guest users

Assess Microsoft Entra ID with AADInternals during authorized security testing. Examine publicly exposed tenant information, API access, and federation weaknesses, including Golden SAML, a token forgery technique, then document evidence and recommendations for stronger identity protection.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping publicly exposed Entra ID tenant information
• Checking API access available through acquired tokens
• Validating AD FS signing certificate protection

在 Windows PowerShell 5.1 与 PowerShell 7 中编写和执行稳定命令，重点处理引号、管道符、原生命令参数传递与跨版本兼容。遇到 `--jq`/过滤表达式被 PowerShell 误解析、同一命令在 pwsh5 与 pwsh7 行为不一致、或需要为 pwsh7.3+ 增加参数传递适配时使用此 skill。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

PowerShell 7+ scripting and Windows system administration -- cross-platform automation, secure credential handling, Pester testing, DSC, and JEA patterns.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.