Can this skill extract URLs and IP addresses?

Yes, once the script is deobfuscated, the skill includes a specific workflow to extract Indicators of Compromise (IOCs) such as URLs, IP addresses, and file paths.

What is AST analysis in the context of PowerShell?

Abstract Syntax Tree (AST) analysis examines the structural representation of the code, allowing the skill to resolve obfuscated strings and logic that static regex might miss.

Is it safe to run these commands on my primary machine?

No, malware analysis should always be performed in an isolated virtual machine or sandbox environment to prevent accidental execution of malicious code.

Which tools are required to use this skill effectively?

You will need PowerShell 5.1+, Python 3.9+, and ideally modules like PSDecode or PowerDecode for advanced automated analysis.

How does this skill handle multi-layer obfuscation?

It uses an iterative process of replacing Invoke-Expression (IEX) with Write-Output to safely unwrap each layer of the script until the final payload is revealed.

PowerShell Malware Deobfuscator

Name: PowerShell Malware Deobfuscator
Author: mukul975

bymukul975

•

4,121

•

Security & Testing

Deobfuscates multi-layer PowerShell malware using AST analysis and dynamic tracing to uncover hidden payloads and C2 infrastructure.

This skill empowers security analysts and incident responders to systematically dismantle complex PowerShell obfuscation layers commonly used in malware. By leveraging Abstract Syntax Tree (AST) analysis, dynamic tracing, and iterative Invoke-Expression (IEX) replacement, it reveals hidden malicious payloads, command-and-control (C2) domains, and encoded scripts. It provides a structured methodology for analyzing suspicious attack artifacts in controlled environments and building robust detection signatures based on offensive scripting patterns.

Key Features

014,121 GitHub stars

02Iterative Invoke-Expression (IEX) replacement to unwrap nested code layers

03Extraction of Indicators of Compromise (IOCs) including URLs, IPs, and domains

04Abstract Syntax Tree (AST) analysis for resolving complex expression nodes

05Guidance for utilizing industry-standard tools like PSDecode and PowerDecode

06Automated detection of Base64, tick-marks, and string concatenation

Use Cases

01Analyzing suspicious PowerShell scripts recovered during incident response

02Developing detection rules for EDR/SIEM platforms based on deobfuscated logic

03Deobfuscating malware payloads to identify C2 infrastructure and dropped files

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills deobfuscating-powershell-obfuscated-malware

For use in Claude.ai and ChatGPT

Key Features

014,121 GitHub stars

02Iterative Invoke-Expression (IEX) replacement to unwrap nested code layers

03Extraction of Indicators of Compromise (IOCs) including URLs, IPs, and domains

04Abstract Syntax Tree (AST) analysis for resolving complex expression nodes

05Guidance for utilizing industry-standard tools like PSDecode and PowerDecode

06Automated detection of Base64, tick-marks, and string concatenation

Use Cases

01Analyzing suspicious PowerShell scripts recovered during incident response

02Developing detection rules for EDR/SIEM platforms based on deobfuscated logic

03Deobfuscating malware payloads to identify C2 infrastructure and dropped files

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add mukul975/anthropic-cybersecurity-skills deobfuscating-powershell-obfuscated-malware

For use in Claude.ai and ChatGPT