PowerShell Malware Deobfuscator
Unpacks layered obfuscated PowerShell malware to reveal hidden commands, payloads and C2 indicators.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
When you hand the agent a suspicious obfuscated PowerShell script, it follows a structured process to peel back the disguises malware authors use, such as Base64 encoding, split strings, character-code tricks and repeated Invoke-Expression calls. It identifies which techniques are present, decodes what it can, and pulls out indicators like URLs, IP addresses, domains, file paths and registry keys. The bundled Python scripts automate parts of this, and the agent writes up the recovered commands for an analyst to review.
Great for
- Incident responders examining a PowerShell script from a compromised Windows machine
- Malware analysts who need to recover payloads and command-and-control endpoints
- Security teams building detections from observed PowerShell tradecraft
Skip it if
- Running unknown malware to see what it does: the skill suggests a VM or sandbox, but scripts that execute samples can still cause harm if isolation fails
- Routine PowerShell scripts you wrote yourself, where the obfuscation analysis adds little value
- Situations without authorization to analyze the sample, since the skill itself frames use around authorized testing and analysis
Try asking
- “Deobfuscate this encoded PowerShell command from our EDR alert and list any URLs or IPs it contacts”
- “Identify which obfuscation techniques are used in this suspicious .ps1 file and decode the Base64 layers”
- “Extract IOCs from this obfuscated PowerShell dropper so I can write detection rules”
- “Walk me through the layers of this multi-stage PowerShell loader and show the final payload”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
deobfuscating-powershell-obfuscated-malware.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip deobfuscating-powershell-obfuscated-malware.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip deobfuscating-powershell-obfuscated-malware.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run analysis inside an isolated VM or sandbox and never execute the sample on a production host.
- Use the IOC extraction mode first to get a quick overview before attempting full deobfuscation.
- Verify decoded output manually, since the regex-based scripts may miss or misdecode custom obfuscation.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.