Suspicious PowerShell hunt (cross-platform ideas)

What this skill does

• Generates a structured hunt plan for PowerShell abuse.
• Focuses on signals that stay useful across tool stacks.

When to use

• You suspect downloader/execution via PowerShell.
• You’re responding to alerts like “EncodedCommand”, “IEX”, “FromBase64String”.

Safety / privacy notes

• Don’t paste full script blocks from production unless permitted.
• Prefer hashing script blocks or sharing key substrings.

Skill instructions