This skill empowers security analysts and incident responders to systematically dismantle complex PowerShell obfuscation layers commonly used in malware. By leveraging Abstract Syntax Tree (AST) analysis, dynamic tracing, and iterative Invoke-Expression (IEX) replacement, it reveals hidden malicious payloads, command-and-control (C2) domains, and encoded scripts. It provides a structured methodology for analyzing suspicious attack artifacts in controlled environments and building robust detection signatures based on offensive scripting patterns.
主要功能
014,121 GitHub stars
02Iterative Invoke-Expression (IEX) replacement to unwrap nested code layers
03Extraction of Indicators of Compromise (IOCs) including URLs, IPs, and domains
04Abstract Syntax Tree (AST) analysis for resolving complex expression nodes
05Guidance for utilizing industry-standard tools like PSDecode and PowerDecode
06Automated detection of Base64, tick-marks, and string concatenation
使用场景
01Analyzing suspicious PowerShell scripts recovered during incident response
02Developing detection rules for EDR/SIEM platforms based on deobfuscated logic
03Deobfuscating malware payloads to identify C2 infrastructure and dropped files