“powershell”的搜索结果

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

中文简介正在准备中。当前显示原文说明。

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

中文简介正在准备中。当前显示原文说明。

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

中文简介正在准备中。当前显示原文说明。

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

中文简介正在准备中。当前显示原文说明。

Detects fileless malware and in-memory attacks that execute entirely in RAM without writing persistent files to disk, evading traditional antivirus. Use when building detections for PowerShell-based attacks, reflective DLL injection, WMI persistence, and registry-resident malware. Activates for requests involving fileless malware detection, in-memory attacks, PowerShell exploitation, or living-off-the-land techniques.

中文简介正在准备中。当前显示原文说明。

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

中文简介正在准备中。当前显示原文说明。

Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.

中文简介正在准备中。当前显示原文说明。

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

中文简介正在准备中。当前显示原文说明。

Check shell commands before they run and warn about destructive actions such as file deletion, database removal, and Git history changes. Users can approve ordinary warnings, while certain catastrophic command patterns are denied.

中文简介正在准备中。当前显示英语简介。

• Check destructive commands in production
• Review deletion commands in shared environments
• Catch Git operations that discard work

Analyze executable files and libraries with IDA Pro. Inspect pseudocode, strings, function calls, and data flow, then add meaningful names and comments and produce a Markdown report documenting findings and analysis steps.

中文简介正在准备中。当前显示英语简介。

• Investigating executable files and libraries
• Tracing processing from strings and function calls
• Organizing analysis with comments and meaningful names

Convert Simplicité text logs into structured JSON while keeping only the fields needed for troubleshooting. Preserve multiline errors and stack traces, and reduce the amount of log content passed to an AI agent for analysis.

中文简介正在准备中。当前显示英语简介。

• Preparing large logs for AI analysis
• Extracting timestamps, severity levels, and messages
• Preserving multiline errors during conversion

Create an agent user in Microsoft Entra ID so an AI agent can access services requiring a user identity. Covers validating the parent agent identity, creating the account, assigning a manager and licenses, and troubleshooting setup errors.

中文简介正在准备中。当前显示英语简介。

• Create a user identity linked to an existing agent identity
• Prepare an agent account for a mailbox and Teams
• Assign a manager for organizational chart visibility

Create and update prompt-based agents in Azure AI Foundry from a local JSON manifest, a file listing agent definitions. The skill prepares synchronization scripts, pushes instructions to the service, and verifies registered agents.

中文简介正在准备中。当前显示英语简介。

• Registering multiple agents from JSON definitions
• Synchronizing changes to agent instructions
• Preparing a manifest and synchronization script

Audit Azure Storage settings for public containers, encryption, access permissions, network restrictions, and logging gaps. Use command-line checks and monitoring alerts to produce findings and remediation guidance across subscriptions.

中文简介正在准备中。当前显示英语简介。

• Auditing storage settings across Azure subscriptions
• Investigating publicly accessible blob containers
• Verifying encryption, network, and logging controls

Build security detection rules in Splunk using SPL, its search language. Use examples for suspicious logins, network traffic, and PowerShell activity to develop searches, add context and severity, test historical logs, and measure false alerts.

中文简介正在准备中。当前显示英语简介。

• Creating rules to detect suspicious login activity
• Detecting large outbound transfers and access to multiple hosts
• Testing detection rules against historical logs

Investigate security incidents in Splunk by connecting authentication, endpoint, and network logs. Use SPL, Splunk’s search language, to identify suspicious activity, reconstruct event timelines, document findings, and develop detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious logins across multiple log sources
• Reconstructing an incident timeline
• Tracing suspicious processes and outbound traffic

Use when writing or running PowerShell on Windows, especially native programs, quoted paths, escaping, pwsh, Start-Process, file operations, or shell troubleshooting.

中文简介正在准备中。当前显示原文说明。

AAD アプリ登録を行わずに、Microsoft Graph API 経由で SharePoint を包括的に操作する。リスト（ドキュメントライブラリ）・列・リスト項目の作成、ファイルアップロード、ページ作成、M365 グループ経由のサイト作成に対応。Microsoft Graph PowerShell の well-known パブリッククライアントで委任認証し、auth_helper.py のキャッシュを再利用する。

中文简介正在准备中。当前显示原文说明。

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

中文简介正在准备中。当前显示原文说明。

Bypass the Windows Antimalware Scan Interface (AMSI) using memory patching, reflection, and obfuscation techniques. Execute undetected PowerShell, VBScript, JScript, and .NET assemblies in-memory without triggering Microsoft Defender or third-party AV/EDR solutions. Use this skill during Red Team engagements when loading offensive tools (Mimikatz, Rubeus, SharpHound) in memory on defended Windows endpoints.

中文简介正在准备中。当前显示原文说明。

Hunts for fileless and in-memory threats by correlating PowerShell script-block logs, encoded-command usage, in-memory loading patterns, and registry-resident payloads from Windows telemetry. Activates for requests to hunt fileless malware, detect in-memory execution, or find registry-resident and reflective-loading activity.

中文简介正在准备中。当前显示原文说明。

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

中文简介正在准备中。当前显示原文说明。

Creates and reviews agent skills safely by enforcing deletion-prevention harness rules: no fixed absolute temp paths, no cwd-dependent cleanup, no wildcard deletes, no workspace-external file operations, no silent cleanup failures, and mandatory temp-root validation before any destructive command. Use when creating a new skill, updating an existing SKILL.md, or reviewing prompts/runbooks that include temp files, extraction, cleanup, PowerShell, bash, rm, del, Remove-Item, or archive expansion.

中文简介正在准备中。当前显示原文说明。

PowerShell Windows patterns. Critical pitfalls, operator syntax, error handling.

中文简介正在准备中。当前显示原文说明。