The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/agent.py uses subprocess.check_output to execute a static PowerShell command for retrieving Windows Script Block logs (Event ID 4104). This execution is limited to local telemetry collection as required for the skill's primary function.
[SAFE]: The skill is developed by vendor 'mukul975' and focuses on legitimate threat detection. It analyzes input data (logs/scripts) for indicators of compromise (IOCs) such as encoded commands, AMSI bypasses, and download cradles without exhibiting any malicious intent or performing unauthorized network operations.
[SAFE]: All external references provided in the documentation point to well-known security resources and official documentation, including MITRE ATT&CK, Sigma, and Microsoft Security APIs.

detecting-suspicious-powershell-execution