Suspicious PowerShell hunt (cross-platform ideas)

202

•published 2026/01/16

Hypothesis-driven hunt plan for suspicious PowerShell, plus query snippets for common telemetry.

Install directly with the `skills` CLI.

npx skills add tsale/awesome-dfir-skills/skills/hunting/suspicious-powershell-hunt

Download only this skill directory.

File Explorer

0 files

No file selected

readonly

Select a file to view its content