Skill UI

Parses Event ID 4104 script block logs from PowerShell Operational EVTX files to reconstruct multi-block commands, score risks, and flag obfuscation, Base64 payloads, download cradles, Invoke-Expression abuse, and AMSI bypass attempts for SOC hunting and detection tuning.

Analyzes PowerShell Script Block, Module, and process creation logs to flag obfuscated commands, AMSI bypass attempts, encoded payloads, download cradles, and credential theft indicators for SOC threat hunting.