[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE75GC90ZFSDKQVJJ954HB":3,"skill-same:01M6AE75GC90ZFSDKQVJJ954HB":139},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AE75GC90ZFSDKQVJJ954HB","deobfuscating-powershell-obfuscated-malware",null,"Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"deobfuscating powershell obfuscated malware","powershell","malware","c2","ast-analysis","obfuscation","scripting","deobfuscation","T1059.001","incident-response","malware-analysis","cybersecurity","malware analysis","encoding","tracing","file","metadata","content","validation","incident response","2026-11-10 10:12:30",false,"---\nname: deobfuscating-powershell-obfuscated-malware\ndescription: Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- powershell\n- deobfuscation\n- malware-analysis\n- scripting\n- obfuscation\n- ast-analysis\n- incident-response\nmitre_attack:\n- T1059.001\n- T1027.010\n- T1140\n- T1027\n- T1620\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\n---\n# Deobfuscating PowerShell Obfuscated Malware\n\n## Overview\n\nPowerShell is heavily abused by malware authors due to its deep Windows integration and powerful scripting capabilities. Obfuscation techniques include string concatenation, Base64 encoding, character substitution, Invoke-Expression layering, SecureString abuse, environment variable manipulation, and tick-mark insertion. Modern malware uses multiple obfuscation layers requiring iterative deobfuscation. Tools like PSDecode, PowerDecode, and PowerPeeler automate much of this process, while manual AST (Abstract Syntax Tree) analysis handles custom obfuscation. PowerPeeler achieves a 95% deobfuscation correctness rate using instruction-level dynamic analysis of expression-related AST nodes.\n\n\n## When to Use\n\n- When performing authorized security testing that involves deobfuscating powershell obfuscated malware\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Python 3.9+ with `base64`, `re`, `subprocess` modules\n- PowerShell 5.1+ or PowerShell 7+ (for AST access)\n- PSDecode (`Install-Module PSDecode`)\n- PowerDecode (https:\u002F\u002Fgithub.com\u002FMalandrone\u002FPowerDecode)\n- Isolated VM or sandbox for safe script execution\n- CyberChef for manual encoding transformations\n- Understanding of PowerShell AST and Invoke-Expression patterns\n\n## Key Concepts\n\n### Common Obfuscation Techniques\n\nPowerShell malware employs layered obfuscation to evade static detection. String concatenation splits commands across variables (`$a='In'+'voke'`). Base64 encoding wraps entire scripts in `-EncodedCommand` parameters. Character code arrays use `[char]` casting (`[char[]](73,69,88)|%{$r+=$_}`). Environment variable abuse reads substrings from `$env:` paths. Tick-mark insertion adds backticks between characters that PowerShell ignores (`I`nv`oke-Exp`ression`). SecureString conversion encrypts strings using ConvertTo-SecureString with embedded keys.\n\n### AST-Based Deobfuscation\n\nPowerShell's Abstract Syntax Tree exposes the parsed structure of scripts regardless of surface-level obfuscation. By walking the AST and evaluating expression nodes, analysts can resolve concatenated strings, decode encoded values, and reconstruct the original commands. PowerPeeler uses this approach at the instruction level, monitoring the execution process to correlate AST nodes with their evaluated results.\n\n### Dynamic Execution Tracing\n\nBy replacing `Invoke-Expression` (IEX) with `Write-Output`, analysts can safely capture the deobfuscated script content that would normally be executed. This technique works across multiple layers by iteratively replacing IEX calls until the final payload is revealed.\n\n## Workflow\n\n### Step 1: Identify Obfuscation Layers\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify and classify PowerShell obfuscation techniques.\"\"\"\nimport re\nimport base64\nimport sys\n\n\ndef analyze_obfuscation(script_content):\n    \"\"\"Identify obfuscation techniques used in PowerShell script.\"\"\"\n    techniques = []\n\n    # Check for Base64 encoded command\n    b64_pattern = re.compile(\n        r'-[Ee](?:nc(?:odedcommand)?)\\s+([A-Za-z0-9+\u002F=]{20,})',\n        re.IGNORECASE\n    )\n    if b64_pattern.search(script_content):\n        techniques.append(\"Base64 EncodedCommand\")\n\n    # Check for FromBase64String\n    if re.search(r'\\[Convert\\]::FromBase64String', script_content, re.IGNORECASE):\n        techniques.append(\"Base64 FromBase64String\")\n\n    # Check for string concatenation\n    concat_count = script_content.count(\"'+'\") + script_content.count('\"+\"')\n    if concat_count > 3:\n        techniques.append(f\"String Concatenation ({concat_count} joins)\")\n\n    # Check for char array construction\n    if re.search(r'\\[char\\]\\s*\\d+', script_content, re.IGNORECASE):\n        techniques.append(\"Character Code Array\")\n\n    # Check for Invoke-Expression variants\n    iex_patterns = [\n        r'Invoke-Expression',\n        r'\\bIEX\\b',\n        r'\\.\\s*\\(\\s*\\$',\n        r'&\\s*\\(\\s*\\$',\n        r'\\|\\s*IEX',\n        r'\\|\\s*Invoke-Expression',\n    ]\n    for pattern in iex_patterns:\n        if re.search(pattern, script_content, re.IGNORECASE):\n            techniques.append(f\"Invoke-Expression variant: {pattern}\")\n\n    # Check for tick-mark obfuscation\n    tick_count = script_content.count('`')\n    if tick_count > 5:\n        techniques.append(f\"Tick-mark Insertion ({tick_count} backticks)\")\n\n    # Check for environment variable abuse\n    if re.search(r'\\$env:', script_content, re.IGNORECASE):\n        env_refs = re.findall(r'\\$env:\\w+', script_content, re.IGNORECASE)\n        if len(env_refs) > 2:\n            techniques.append(f\"Environment Variable Abuse ({len(env_refs)} refs)\")\n\n    # Check for SecureString\n    if re.search(r'ConvertTo-SecureString', script_content, re.IGNORECASE):\n        techniques.append(\"SecureString Encryption\")\n\n    # Check for compression\n    if re.search(r'IO\\.Compression|DeflateStream|GZipStream',\n                 script_content, re.IGNORECASE):\n        techniques.append(\"Compression (Deflate\u002FGZip)\")\n\n    # Check for XOR encoding\n    if re.search(r'-bxor\\s+\\d+', script_content, re.IGNORECASE):\n        techniques.append(\"XOR Encoding\")\n\n    # Check for Replace chain\n    replace_count = len(re.findall(r'\\.Replace\\(', script_content))\n    if replace_count > 2:\n        techniques.append(f\"Replace Chain ({replace_count} replacements)\")\n\n    return techniques\n\n\ndef decode_base64_command(script_content):\n    \"\"\"Extract and decode Base64 encoded commands.\"\"\"\n    b64_match = re.search(\n        r'-[Ee](?:nc(?:odedcommand)?)\\s+([A-Za-z0-9+\u002F=]{20,})',\n        script_content, re.IGNORECASE\n    )\n    if b64_match:\n        encoded = b64_match.group(1)\n        try:\n            decoded = base64.b64decode(encoded).decode('utf-16-le')\n            return decoded\n        except Exception:\n            return None\n    return None\n\n\ndef remove_tick_marks(script_content):\n    \"\"\"Remove PowerShell tick-mark obfuscation.\"\"\"\n    # Remove backticks that are not escape sequences\n    escape_chars = {'`n', '`r', '`t', '`a', '`b', '`f', '`v', '`0', '``'}\n    result = []\n    i = 0\n    while i \u003C len(script_content):\n        if script_content[i] == '`' and i + 1 \u003C len(script_content):\n            pair = script_content[i:i+2]\n            if pair in escape_chars:\n                result.append(pair)\n                i += 2\n            else:\n                # Skip the backtick, keep the next char\n                result.append(script_content[i+1])\n                i += 2\n        else:\n            result.append(script_content[i])\n            i += 1\n    return ''.join(result)\n\n\ndef resolve_string_concat(script_content):\n    \"\"\"Resolve simple string concatenation patterns.\"\"\"\n    # Pattern: 'str1' + 'str2'\n    pattern = re.compile(r\"'([^']*)'\\s*\\+\\s*'([^']*)'\")\n    while pattern.search(script_content):\n        script_content = pattern.sub(lambda m: f\"'{m.group(1)}{m.group(2)}'\",\n                                      script_content)\n    # Pattern: \"str1\" + \"str2\"\n    pattern = re.compile(r'\"([^\"]*)\"\\s*\\+\\s*\"([^\"]*)\"')\n    while pattern.search(script_content):\n        script_content = pattern.sub(lambda m: f'\"{m.group(1)}{m.group(2)}\"',\n                                      script_content)\n    return script_content\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cpowershell_script>\")\n        sys.exit(1)\n\n    with open(sys.argv[1], 'r', errors='replace') as f:\n        content = f.read()\n\n    print(\"[+] Obfuscation Analysis\")\n    print(\"=\" * 60)\n    techniques = analyze_obfuscation(content)\n    for t in techniques:\n        print(f\"  - {t}\")\n\n    # Attempt automatic deobfuscation\n    print(\"\\n[+] Attempting Deobfuscation\")\n    print(\"=\" * 60)\n\n    # Layer 1: Remove tick marks\n    deobfuscated = remove_tick_marks(content)\n\n    # Layer 2: Resolve string concatenation\n    deobfuscated = resolve_string_concat(deobfuscated)\n\n    # Layer 3: Decode Base64\n    b64_decoded = decode_base64_command(deobfuscated)\n    if b64_decoded:\n        print(\"[+] Base64 decoded content:\")\n        print(b64_decoded[:2000])\n        deobfuscated = b64_decoded\n\n    print(f\"\\n[+] Deobfuscated script length: {len(deobfuscated)} chars\")\n    output_file = sys.argv[1] + \".deobfuscated.ps1\"\n    with open(output_file, 'w') as f:\n        f.write(deobfuscated)\n    print(f\"[+] Saved to {output_file}\")\n```\n\n### Step 2: Multi-Layer IEX Replacement\n\n```python\nimport subprocess\nimport tempfile\nimport os\n\ndef iex_replacement_deobfuscate(script_content, max_layers=10):\n    \"\"\"Iteratively replace IEX with Write-Output to unwrap layers.\"\"\"\n    # IEX replacement patterns\n    replacements = [\n        (r'\\bInvoke-Expression\\b', 'Write-Output'),\n        (r'\\bIEX\\b', 'Write-Output'),\n        (r'\\|\\s*IEX\\b', '| Write-Output'),\n    ]\n\n    current = script_content\n    layers = []\n\n    for layer_num in range(max_layers):\n        # Apply IEX replacements\n        modified = current\n        for pattern, replacement in replacements:\n            modified = re.sub(pattern, replacement, modified, flags=re.IGNORECASE)\n\n        if modified == current and layer_num > 0:\n            print(f\"  [+] No more IEX layers found at layer {layer_num}\")\n            break\n\n        # Write to temp file and execute in constrained PowerShell\n        with tempfile.NamedTemporaryFile(mode='w', suffix='.ps1',\n                                          delete=False) as tmp:\n            tmp.write(modified)\n            tmp_path = tmp.name\n\n        try:\n            result = subprocess.run(\n                ['powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass',\n                 '-File', tmp_path],\n                capture_output=True, text=True, timeout=30\n            )\n\n            output = result.stdout.strip()\n            if output and output != current:\n                print(f\"  [+] Layer {layer_num + 1}: Unwrapped \"\n                      f\"{len(output)} chars\")\n                layers.append({\n                    \"layer\": layer_num + 1,\n                    \"technique\": \"IEX replacement\",\n                    \"content_length\": len(output),\n                })\n                current = output\n            else:\n                break\n\n        except subprocess.TimeoutExpired:\n            print(f\"  [!] Layer {layer_num + 1}: Execution timeout\")\n            break\n        finally:\n            os.unlink(tmp_path)\n\n    return current, layers\n```\n\n### Step 3: Extract IOCs from Deobfuscated Script\n\n```python\ndef extract_iocs_from_script(deobfuscated_content):\n    \"\"\"Extract indicators of compromise from deobfuscated PowerShell.\"\"\"\n    iocs = {\n        \"urls\": [],\n        \"ips\": [],\n        \"domains\": [],\n        \"file_paths\": [],\n        \"registry_keys\": [],\n        \"commands\": [],\n        \"base64_blobs\": [],\n    }\n\n    # URLs\n    url_pattern = re.compile(\n        r'https?:\u002F\u002F[^\\s\\'\"\u003C>)\\]]+', re.IGNORECASE\n    )\n    iocs[\"urls\"] = list(set(url_pattern.findall(deobfuscated_content)))\n\n    # IP addresses\n    ip_pattern = re.compile(\n        r'\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\n    )\n    iocs[\"ips\"] = list(set(ip_pattern.findall(deobfuscated_content)))\n\n    # File paths\n    path_pattern = re.compile(\n        r'[A-Za-z]:\\\\[^\\s\\'\"\u003C>|]+|'\n        r'\\\\\\\\[^\\s\\'\"\u003C>|]+|'\n        r'%(?:APPDATA|TEMP|USERPROFILE|PROGRAMFILES)%[^\\s\\'\"\u003C>|]*',\n        re.IGNORECASE\n    )\n    iocs[\"file_paths\"] = list(set(path_pattern.findall(deobfuscated_content)))\n\n    # Registry keys\n    reg_pattern = re.compile(\n        r'(?:HKLM|HKCU|HKCR|HKU|HKCC)(?:\\\\[^\\s\\'\"\u003C>|]+)+',\n        re.IGNORECASE\n    )\n    iocs[\"registry_keys\"] = list(set(reg_pattern.findall(deobfuscated_content)))\n\n    # Suspicious commands\n    suspicious_cmds = [\n        'New-Object Net.WebClient',\n        'DownloadString', 'DownloadFile', 'DownloadData',\n        'Start-Process', 'Invoke-WebRequest',\n        'New-Object IO.MemoryStream',\n        'Reflection.Assembly',\n        'Add-MpPreference -ExclusionPath',\n        'Set-MpPreference -DisableRealtimeMonitoring',\n        'New-ScheduledTask', 'Register-ScheduledTask',\n    ]\n    for cmd in suspicious_cmds:\n        if cmd.lower() in deobfuscated_content.lower():\n            iocs[\"commands\"].append(cmd)\n\n    return iocs\n```\n\n## Validation Criteria\n\n- All obfuscation layers identified and classified correctly\n- Base64 encoded commands decoded to readable PowerShell\n- Tick-mark and string concatenation obfuscation resolved\n- IEX replacement reveals next-stage payloads\n- URLs, IPs, and file paths extracted from final deobfuscated stage\n- Deobfuscated script matches observed malware behavior in sandbox\n\n## References\n\n- [PSDecode - PowerShell Deobfuscation](https:\u002F\u002Fgithub.com\u002FR3MRUM\u002FPSDecode)\n- [PowerDecode - Multi-layer Deobfuscation](https:\u002F\u002Fgithub.com\u002FMalandrone\u002FPowerDecode)\n- [PowerPeeler - Instruction-level Deobfuscation](https:\u002F\u002Farxiv.org\u002Fhtml\u002F2406.04027v2)\n- [SentinelOne - Deconstructing PowerShell Obfuscation](https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Fdeconstructing-powershell-obfuscation-in-malspam-campaigns\u002F)\n- [MITRE ATT&CK T1059.001 - PowerShell](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F001\u002F)\n","# Deobfuscating PowerShell Obfuscated Malware\n\n## Overview\n\nPowerShell is heavily abused by malware authors due to its deep Windows integration and powerful scripting capabilities. Obfuscation techniques include string concatenation, Base64 encoding, character substitution, Invoke-Expression layering, SecureString abuse, environment variable manipulation, and tick-mark insertion. Modern malware uses multiple obfuscation layers requiring iterative deobfuscation. Tools like PSDecode, PowerDecode, and PowerPeeler automate much of this process, while manual AST (Abstract Syntax Tree) analysis handles custom obfuscation. PowerPeeler achieves a 95% deobfuscation correctness rate using instruction-level dynamic analysis of expression-related AST nodes.\n\n\n## When to Use\n\n- When performing authorized security testing that involves deobfuscating powershell obfuscated malware\n- When analyzing malware samples or attack artifacts in a controlled environment\n- When conducting red team exercises or penetration testing engagements\n- When building detection capabilities based on offensive technique understanding\n\n## Prerequisites\n\n- Python 3.9+ with `base64`, `re`, `subprocess` modules\n- PowerShell 5.1+ or PowerShell 7+ (for AST access)\n- PSDecode (`Install-Module PSDecode`)\n- PowerDecode (https:\u002F\u002Fgithub.com\u002FMalandrone\u002FPowerDecode)\n- Isolated VM or sandbox for safe script execution\n- CyberChef for manual encoding transformations\n- Understanding of PowerShell AST and Invoke-Expression patterns\n\n## Key Concepts\n\n### Common Obfuscation Techniques\n\nPowerShell malware employs layered obfuscation to evade static detection. String concatenation splits commands across variables (`$a='In'+'voke'`). Base64 encoding wraps entire scripts in `-EncodedCommand` parameters. Character code arrays use `[char]` casting (`[char[]](73,69,88)|%{$r+=$_}`). Environment variable abuse reads substrings from `$env:` paths. Tick-mark insertion adds backticks between characters that PowerShell ignores (`I`nv`oke-Exp`ression`). SecureString conversion encrypts strings using ConvertTo-SecureString with embedded keys.\n\n### AST-Based Deobfuscation\n\nPowerShell's Abstract Syntax Tree exposes the parsed structure of scripts regardless of surface-level obfuscation. By walking the AST and evaluating expression nodes, analysts can resolve concatenated strings, decode encoded values, and reconstruct the original commands. PowerPeeler uses this approach at the instruction level, monitoring the execution process to correlate AST nodes with their evaluated results.\n\n### Dynamic Execution Tracing\n\nBy replacing `Invoke-Expression` (IEX) with `Write-Output`, analysts can safely capture the deobfuscated script content that would normally be executed. This technique works across multiple layers by iteratively replacing IEX calls until the final payload is revealed.\n\n## Workflow\n\n### Step 1: Identify Obfuscation Layers\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Identify and classify PowerShell obfuscation techniques.\"\"\"\nimport re\nimport base64\nimport sys\n\n\ndef analyze_obfuscation(script_content):\n    \"\"\"Identify obfuscation techniques used in PowerShell script.\"\"\"\n    techniques = []\n\n    # Check for Base64 encoded command\n    b64_pattern = re.compile(\n        r'-[Ee](?:nc(?:odedcommand)?)\\s+([A-Za-z0-9+\u002F=]{20,})',\n        re.IGNORECASE\n    )\n    if b64_pattern.search(script_content):\n        techniques.append(\"Base64 EncodedCommand\")\n\n    # Check for FromBase64String\n    if re.search(r'\\[Convert\\]::FromBase64String', script_content, re.IGNORECASE):\n        techniques.append(\"Base64 FromBase64String\")\n\n    # Check for string concatenation\n    concat_count = script_content.count(\"'+'\") + script_content.count('\"+\"')\n    if concat_count > 3:\n        techniques.append(f\"String Concatenation ({concat_count} joins)\")\n\n    # Check for char array construction\n    if re.search(r'\\[char\\]\\s*\\d+', script_content, re.IGNORECASE):\n        techniques.append(\"Character Code Array\")\n\n    # Check for Invoke-Expression variants\n    iex_patterns = [\n        r'Invoke-Expression',\n        r'\\bIEX\\b',\n        r'\\.\\s*\\(\\s*\\$',\n        r'&\\s*\\(\\s*\\$',\n        r'\\|\\s*IEX',\n        r'\\|\\s*Invoke-Expression',\n    ]\n    for pattern in iex_patterns:\n        if re.search(pattern, script_content, re.IGNORECASE):\n            techniques.append(f\"Invoke-Expression variant: {pattern}\")\n\n    # Check for tick-mark obfuscation\n    tick_count = script_content.count('`')\n    if tick_count > 5:\n        techniques.append(f\"Tick-mark Insertion ({tick_count} backticks)\")\n\n    # Check for environment variable abuse\n    if re.search(r'\\$env:', script_content, re.IGNORECASE):\n        env_refs = re.findall(r'\\$env:\\w+', script_content, re.IGNORECASE)\n        if len(env_refs) > 2:\n            techniques.append(f\"Environment Variable Abuse ({len(env_refs)} refs)\")\n\n    # Check for SecureString\n    if re.search(r'ConvertTo-SecureString', script_content, re.IGNORECASE):\n        techniques.append(\"SecureString Encryption\")\n\n    # Check for compression\n    if re.search(r'IO\\.Compression|DeflateStream|GZipStream',\n                 script_content, re.IGNORECASE):\n        techniques.append(\"Compression (Deflate\u002FGZip)\")\n\n    # Check for XOR encoding\n    if re.search(r'-bxor\\s+\\d+', script_content, re.IGNORECASE):\n        techniques.append(\"XOR Encoding\")\n\n    # Check for Replace chain\n    replace_count = len(re.findall(r'\\.Replace\\(', script_content))\n    if replace_count > 2:\n        techniques.append(f\"Replace Chain ({replace_count} replacements)\")\n\n    return techniques\n\n\ndef decode_base64_command(script_content):\n    \"\"\"Extract and decode Base64 encoded commands.\"\"\"\n    b64_match = re.search(\n        r'-[Ee](?:nc(?:odedcommand)?)\\s+([A-Za-z0-9+\u002F=]{20,})',\n        script_content, re.IGNORECASE\n    )\n    if b64_match:\n        encoded = b64_match.group(1)\n        try:\n            decoded = base64.b64decode(encoded).decode('utf-16-le')\n            return decoded\n        except Exception:\n            return None\n    return None\n\n\ndef remove_tick_marks(script_content):\n    \"\"\"Remove PowerShell tick-mark obfuscation.\"\"\"\n    # Remove backticks that are not escape sequences\n    escape_chars = {'`n', '`r', '`t', '`a', '`b', '`f', '`v', '`0', '``'}\n    result = []\n    i = 0\n    while i \u003C len(script_content):\n        if script_content[i] == '`' and i + 1 \u003C len(script_content):\n            pair = script_content[i:i+2]\n            if pair in escape_chars:\n                result.append(pair)\n                i += 2\n            else:\n                # Skip the backtick, keep the next char\n                result.append(script_content[i+1])\n                i += 2\n        else:\n            result.append(script_content[i])\n            i += 1\n    return ''.join(result)\n\n\ndef resolve_string_concat(script_content):\n    \"\"\"Resolve simple string concatenation patterns.\"\"\"\n    # Pattern: 'str1' + 'str2'\n    pattern = re.compile(r\"'([^']*)'\\s*\\+\\s*'([^']*)'\")\n    while pattern.search(script_content):\n        script_content = pattern.sub(lambda m: f\"'{m.group(1)}{m.group(2)}'\",\n                                      script_content)\n    # Pattern: \"str1\" + \"str2\"\n    pattern = re.compile(r'\"([^\"]*)\"\\s*\\+\\s*\"([^\"]*)\"')\n    while pattern.search(script_content):\n        script_content = pattern.sub(lambda m: f'\"{m.group(1)}{m.group(2)}\"',\n                                      script_content)\n    return script_content\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) \u003C 2:\n        print(f\"Usage: {sys.argv[0]} \u003Cpowershell_script>\")\n        sys.exit(1)\n\n    with open(sys.argv[1], 'r', errors='replace') as f:\n        content = f.read()\n\n    print(\"[+] Obfuscation Analysis\")\n    print(\"=\" * 60)\n    techniques = analyze_obfuscation(content)\n    for t in techniques:\n        print(f\"  - {t}\")\n\n    # Attempt automatic deobfuscation\n    print(\"\\n[+] Attempting Deobfuscation\")\n    print(\"=\" * 60)\n\n    # Layer 1: Remove tick marks\n    deobfuscated = remove_tick_marks(content)\n\n    # Layer 2: Resolve string concatenation\n    deobfuscated = resolve_string_concat(deobfuscated)\n\n    # Layer 3: Decode Base64\n    b64_decoded = decode_base64_command(deobfuscated)\n    if b64_decoded:\n        print(\"[+] Base64 decoded content:\")\n        print(b64_decoded[:2000])\n        deobfuscated = b64_decoded\n\n    print(f\"\\n[+] Deobfuscated script length: {len(deobfuscated)} chars\")\n    output_file = sys.argv[1] + \".deobfuscated.ps1\"\n    with open(output_file, 'w') as f:\n        f.write(deobfuscated)\n    print(f\"[+] Saved to {output_file}\")\n```\n\n### Step 2: Multi-Layer IEX Replacement\n\n```python\nimport subprocess\nimport tempfile\nimport os\n\ndef iex_replacement_deobfuscate(script_content, max_layers=10):\n    \"\"\"Iteratively replace IEX with Write-Output to unwrap layers.\"\"\"\n    # IEX replacement patterns\n    replacements = [\n        (r'\\bInvoke-Expression\\b', 'Write-Output'),\n        (r'\\bIEX\\b', 'Write-Output'),\n        (r'\\|\\s*IEX\\b', '| Write-Output'),\n    ]\n\n    current = script_content\n    layers = []\n\n    for layer_num in range(max_layers):\n        # Apply IEX replacements\n        modified = current\n        for pattern, replacement in replacements:\n            modified = re.sub(pattern, replacement, modified, flags=re.IGNORECASE)\n\n        if modified == current and layer_num > 0:\n            print(f\"  [+] No more IEX layers found at layer {layer_num}\")\n            break\n\n        # Write to temp file and execute in constrained PowerShell\n        with tempfile.NamedTemporaryFile(mode='w', suffix='.ps1',\n                                          delete=False) as tmp:\n            tmp.write(modified)\n            tmp_path = tmp.name\n\n        try:\n            result = subprocess.run(\n                ['powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass',\n                 '-File', tmp_path],\n                capture_output=True, text=True, timeout=30\n            )\n\n            output = result.stdout.strip()\n            if output and output != current:\n                print(f\"  [+] Layer {layer_num + 1}: Unwrapped \"\n                      f\"{len(output)} chars\")\n                layers.append({\n                    \"layer\": layer_num + 1,\n                    \"technique\": \"IEX replacement\",\n                    \"content_length\": len(output),\n                })\n                current = output\n            else:\n                break\n\n        except subprocess.TimeoutExpired:\n            print(f\"  [!] Layer {layer_num + 1}: Execution timeout\")\n            break\n        finally:\n            os.unlink(tmp_path)\n\n    return current, layers\n```\n\n### Step 3: Extract IOCs from Deobfuscated Script\n\n```python\ndef extract_iocs_from_script(deobfuscated_content):\n    \"\"\"Extract indicators of compromise from deobfuscated PowerShell.\"\"\"\n    iocs = {\n        \"urls\": [],\n        \"ips\": [],\n        \"domains\": [],\n        \"file_paths\": [],\n        \"registry_keys\": [],\n        \"commands\": [],\n        \"base64_blobs\": [],\n    }\n\n    # URLs\n    url_pattern = re.compile(\n        r'https?:\u002F\u002F[^\\s\\'\"\u003C>)\\]]+', re.IGNORECASE\n    )\n    iocs[\"urls\"] = list(set(url_pattern.findall(deobfuscated_content)))\n\n    # IP addresses\n    ip_pattern = re.compile(\n        r'\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b'\n    )\n    iocs[\"ips\"] = list(set(ip_pattern.findall(deobfuscated_content)))\n\n    # File paths\n    path_pattern = re.compile(\n        r'[A-Za-z]:\\\\[^\\s\\'\"\u003C>|]+|'\n        r'\\\\\\\\[^\\s\\'\"\u003C>|]+|'\n        r'%(?:APPDATA|TEMP|USERPROFILE|PROGRAMFILES)%[^\\s\\'\"\u003C>|]*',\n        re.IGNORECASE\n    )\n    iocs[\"file_paths\"] = list(set(path_pattern.findall(deobfuscated_content)))\n\n    # Registry keys\n    reg_pattern = re.compile(\n        r'(?:HKLM|HKCU|HKCR|HKU|HKCC)(?:\\\\[^\\s\\'\"\u003C>|]+)+',\n        re.IGNORECASE\n    )\n    iocs[\"registry_keys\"] = list(set(reg_pattern.findall(deobfuscated_content)))\n\n    # Suspicious commands\n    suspicious_cmds = [\n        'New-Object Net.WebClient',\n        'DownloadString', 'DownloadFile', 'DownloadData',\n        'Start-Process', 'Invoke-WebRequest',\n        'New-Object IO.MemoryStream',\n        'Reflection.Assembly',\n        'Add-MpPreference -ExclusionPath',\n        'Set-MpPreference -DisableRealtimeMonitoring',\n        'New-ScheduledTask', 'Register-ScheduledTask',\n    ]\n    for cmd in suspicious_cmds:\n        if cmd.lower() in deobfuscated_content.lower():\n            iocs[\"commands\"].append(cmd)\n\n    return iocs\n```\n\n## Validation Criteria\n\n- All obfuscation layers identified and classified correctly\n- Base64 encoded commands decoded to readable PowerShell\n- Tick-mark and string concatenation obfuscation resolved\n- IEX replacement reveals next-stage payloads\n- URLs, IPs, and file paths extracted from final deobfuscated stage\n- Deobfuscated script matches observed malware behavior in sandbox\n\n## References\n\n- [PSDecode - PowerShell Deobfuscation](https:\u002F\u002Fgithub.com\u002FR3MRUM\u002FPSDecode)\n- [PowerDecode - Multi-layer Deobfuscation](https:\u002F\u002Fgithub.com\u002FMalandrone\u002FPowerDecode)\n- [PowerPeeler - Instruction-level Deobfuscation](https:\u002F\u002Farxiv.org\u002Fhtml\u002F2406.04027v2)\n- [SentinelOne - Deconstructing PowerShell Obfuscation](https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Fdeconstructing-powershell-obfuscation-in-malspam-campaigns\u002F)\n- [MITRE ATT&CK T1059.001 - PowerShell](https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1059\u002F001\u002F)\n",{"name":5,"tags":49,"author":50,"domain":35,"license":15,"version":51,"nist_csf":52,"subdomain":34,"description":7,"mitre_attack":57,"d3fend_techniques":62},[25,31,34,30,29,28,33],"mahipal","1.0",[53,54,55,56],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01",[32,58,59,60,61],"T1027.010","T1140","T1027","T1620",[63,64,65,66,67],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdeobfuscating-powershell-obfuscated-malware",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deobfuscating-powershell-obfuscated-malware",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deobfuscating-powershell-obfuscated-malware",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill deobfuscating-powershell-obfuscated-malware","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002FSKILL.md",true,[92,98,103,109,113,117,121,125,129,135],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"assets\u002Ftemplate.md","ASSET","资产文件",1353,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Fassets\u002Ftemplate.md",{"path":99,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002FLICENSE",{"path":104,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"references\u002Fapi-reference.md","REFERENCE","参考文档",1425,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Freferences\u002Fapi-reference.md",{"path":110,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fdocs-context.md",2373,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-matrix-transform-physics-sprite\u002Freferences\u002Fdocs-context.md",{"path":114,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Ffresh-pattern-catalog.md",2948,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-matrix-transform-physics-sprite\u002Freferences\u002Ffresh-pattern-catalog.md",{"path":118,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Frejected-snippets.md",1770,"https:\u002F\u002Fgithub.com\u002Fmakura-games\u002Fsunrise-station\u002Fblob\u002Fmaster\u002F.agents\u002Fskills\u002Fss14-matrix-transform-physics-sprite\u002Freferences\u002Frejected-snippets.md",{"path":122,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":123,"sourceHtmlUrl":124},"references\u002Fstandards.md",1907,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Freferences\u002Fstandards.md",{"path":126,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":127,"sourceHtmlUrl":128},"references\u002Fworkflows.md",2348,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Freferences\u002Fworkflows.md",{"path":130,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":133,"sourceHtmlUrl":134},"scripts\u002Fagent.py","SCRIPT","脚本",5229,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Fscripts\u002Fagent.py",{"path":136,"resourceType":131,"resourceTypeDesc":132,"sizeBytes":137,"sourceHtmlUrl":138},"scripts\u002Fprocess.py",10939,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdeobfuscating-powershell-obfuscated-malware\u002Fscripts\u002Fprocess.py",[140,166,190,216,242,269],{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":147,"publishedAt":44},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[146],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[148,149,150,151,152,35,43,153,154,155,156,157,158,159,160,161,162,163,164,165],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":173,"publishedAt":44},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[172],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[174,162,175,176,152,177,35,154,178,179,180,181,182,183,184,185,186,187,188,189],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":191,"name":192,"nameZh":6,"description":193,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":194,"categories":195,"keywords":200,"publishedAt":44},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[196,199],{"categoryNo":197,"categoryName":198,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[184,201,202,203,204,35,205,42,178,206,207,33,208,209,210,211,212,213,214,215],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":223,"publishedAt":44},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[222],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[224,225,226,35,227,228,229,230,231,232,233,234,235,236,237,238,181,239,240,241],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":243,"name":244,"nameZh":6,"description":245,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":246,"categories":247,"keywords":249,"publishedAt":44},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[248],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[250,251,252,35,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":270,"name":271,"nameZh":6,"description":272,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":273,"categories":274,"keywords":276,"publishedAt":44},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[275],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[152,277,35,278,39,279,280,281,282,283,284,211,285,212,286,287,288,289,290,291],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]