PowerShell Deobfuscator

Malicious PowerShell scripts often hide their intent behind layers of encoding, string manipulation, and compression to bypass static analysis. This skill statically deobfuscates commands and script droppers to reveal their actual behavior without the risk of execution.

What it does

• Base64 decoding handles -EncodedCommand (UTF-16LE) and nested Base64 strings.
• Stream decompression extracts payloads from IO.Compression Gzip and Deflate streams.
• String reconstruction resolves [char] arrays, -join operations, and -f format-operator reordering.
• Escape removal cleans backtick and caret escapes used to evade signature detection.
• IOC extraction pulls URLs, IP addresses, domains, and file paths from every layer of the script.
• Behavioral mapping identifies download cradles, AMSI bypasses, and persistence mechanisms.

How it works

1. Input ingestion via file path, direct command string, or piped input.
2. Iterative decoding to strip layers of obfuscation until the code reaches a stable state.
3. Static analysis of the resulting script to identify malicious patterns and techniques.
4. Report generation showing the final script, transformations applied, and extracted indicators.

Frameworks & tools

Uses a Python based static analysis engine specifically tuned for PowerShell syntax, IO.Compression libraries, and regex-based IOC extraction.

Why this beats prompting it yourself

Generic LLM prompts often hallucinate the output of complex nested loops or fail to correctly reorder -f formatted strings. This skill uses a systematic, multi-layer approach to ensure every transformation is captured and documented, providing a reliable audit trail for security analysts.

Use cases

• Alert triage for command lines flagged by EDR or SIEM systems.
• Email analysis to decode scripts found in malicious attachments or links.
• Incident response to map attacker behavior to the MITRE ATT&CK framework.
• Threat hunting by extracting IOCs from newly discovered samples.

Known limitations

Does not support dynamic decryption where keys are generated at runtime. In these cases, it identifies the blockage and recommends sandbox detonation.