What it does. Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/deobfuscating-powershell-obfuscated-malware/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill deobfuscating-powershell-obfuscated-malware, or copy the skill folder into ~/.claude/skills/deobfuscating-powershell-obfuscated-malware/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/deobfuscating-powershell-obfuscated-malware/SKILL.md

SKILL.md (verbatim)

name: deobfuscating-powershell-obfuscated-malware
description: Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.
domain: cybersecurity
subdomain: malware-analysis
tags:
- powershell
- deobfuscation
- malware-analysis
- scripting
- obfuscation
- ast-analysis
- incident-response
mitre_attack:
- T1059.001
- T1027.010
- T1140
- T1027
- T1620
version: '1.0'
author: mahipal
license: Apache-2.0
d3fend_techniques:
- Executable Denylisting
- Execution Isolation
- File Metadata Consistency Validation
- Content Format Conversion
- File Content Analysis
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01

Deobfuscating PowerShell Obfuscated Malware

Overview

PowerShell is heavily abused by malware authors due to its deep Windows integration and powerful scripting capabilities. Obfuscation techniques include string concatenation, Base64 encoding, character substitution, Invoke-Expression layering, SecureString abuse, environment variable manipulation, and tick-mark insertion. Modern malware uses multiple obfuscation layers requiring iterative deobfuscation. Tools like PSDecode, PowerDecode, and PowerPeeler automate much of this process, while manual AST (Abstract Syntax Tree) analysis handles custom obfuscation. PowerPeeler achieves a 95% deobfuscation correctness rate using instruction-level dynamic analysis of expression-related AST nodes.

When to Use

• When performing authorized security testing that involves deobfuscating powershell obfuscated malware
• When analyzing malware samples or attack artifacts in a controlled environment
• When conducting red team exercises or penetration testing engagements
• When building detection capabilities based on offensive technique understanding

Prerequisites

• Python 3.9+ with base64, re, subprocess modules
• PowerShell 5.1+ or PowerShell 7+ (for AST access)
• PSDecode (Install-Module PSDecode)
• PowerDecode (https://github.com/Malandrone/PowerDecode)
• Isolated VM or sandbox for safe script execution
• CyberChef for manual encoding transformations
• Understanding of PowerShell AST and Invoke-Expression patterns

Key Concepts

Common Obfuscation Techniques

PowerShell malware employs layered obfuscation to evade static detection. String concatenation splits commands across variables ($a='In'+'voke'). Base64 encoding wraps entire scripts in -EncodedCommand parameters. Character code arrays use [char] casting ([char[]](73,69,88)|%{$r+=$_}). Environment variable abuse reads substrings from $env: paths. Tick-mark insertion adds backticks between characters that PowerShell ignores (Invoke-Expression`). SecureString conversion encrypts strings using ConvertTo-SecureString with embedded keys.

AST-Based Deobfuscation

PowerShell's Abstract Syntax Tree exposes the parsed structure of scripts regardless of surface-level obfuscation. By walking the AST and evaluating expression nodes, analysts can resolve concatenated strings, decode encoded values, and reconstruct the original commands. PowerPeeler uses this approach at the instruction level, monitoring the execution process to correlate AST nodes with their evaluated results.

Dynamic Execution Tracing

By replacing Invoke-Expression (IEX) with Write-Output, analysts can safely capture the deobfuscated script content that would normally be executed. This technique works across multiple layers by iteratively replacing IEX calls until the final payload is revealed.

Workflow

Step 1: Identify Obfuscation Layers

#!/usr/bin/env python3
"""Identify and classify PowerShell obfuscation techniques."""
import re
import base64
import sys


def analyze_obfuscation(script_content):
    """Identify obfuscation techniques used in PowerShell script."""
    techniques = []

    # Check for Base64 encoded command
    b64_pattern = re.compile(
        r'-[Ee](?:nc(?:odedcommand)?)\s+([A-Za-z0-9+/=]{20,})',
        re.IGNORECASE
    )
    if b64_pattern.search(script_content):
        techniques.append("Base64 EncodedCommand")

    # Check for FromBase64String
    if re.search(r'\[Convert\]::FromBase64String', script_content, re.IGNORECASE):
        techniques.append("Base64 FromBase64String")

    # Check for string concatenation
    concat_count = script_content.count("'+'") + script_content.count('"+"')
    if concat_count > 3:
        techniques.append(f"String Concatenation ({concat_count} joins)")

    # Check for char array construction
    if re.search(r'\[char\]\s*\d+', script_content, re.IGNORECASE):
        techniques.append("Character Code Array")

    # Check for Invoke-Expression variants
    iex_patterns = [
        r'Invoke-Expression',
        r'\bIEX\b',
        r'\.\s*\(\s*\$',
        r'&\s*\(\s*\$',
        r'\|\s*IEX',
        r'\|\s*Invoke-Expression',
    ]
    for pattern in iex_patterns:
        if re.search(pattern, script_content, re.IGNORECASE):
            techniques.append(f"Invoke-Expression variant: {pattern}")

    # Check for tick-mark obfuscation
    tick_count = script_content.count('`')
    if tick_count > 5:
        techniques.append(f"Tick-mark Insertion ({tick_count} backticks)")

    # Check for environment variable abuse
    if re.search(r'\$env:', script_content, re.IGNORECASE):
        env_refs = re.findall(r'\$env:\w+', script_content, re.IGNORECASE)
        if len(env_refs) > 2:
            techniques.append(f"Environment Variable Abuse ({len(env_refs)} refs)")

    # Check for SecureString
    if re.search(r'ConvertTo-SecureString', script_content, re.IGNORECASE):
        techniques.append("SecureString Encryption")

    # Check for compression
    if re.search(r'IO\.Compression|DeflateStream|GZipStream',
                 script_content, re.IGNORECASE):
        techniques.append("Compression (Deflate/GZip)")

    # Check for XOR encoding
    if re.search(r'-bxor\s+\d+', script_content, re.IGNORECASE):
        techniques.append("XOR Encoding")

    # Check for Replace chain
    replace_count = len(re.findall(r'\.Replace\(', script_content))
    if replace_count > 2:
        techniques.append(f"Replace Chain ({replace_count} replacements)")

    return techniques


def decode_base64_command(script_content):
    """Extract and decode Base64 encoded commands."""
    b64_match = re.search(
        r'-[Ee](?:nc(?:odedcommand)?)\s+([A-Za-z0-9+/=]{20,})',
        script_content, re.IGNORECASE
    )
    if b64_match:
        encoded = b64_match.group(1)
        try:
            decoded = base64.b64decode(encoded).decode('utf-16-le')
            return decoded
        except Exception:
            return None
    return None


def remove_tick_marks(script_content):
    """Remove PowerShell tick-mark obfuscation."""
    # Remove backticks that are not escape sequences
    escape_chars = {'`n', '`r', '`t', '`a', '`b', '`f', '`v', '`0', '``'}
    result = []
    i = 0
    while i < len(script_content):
        if script_content[i] == '`' and i + 1 < len(script_content):
            pair = script_content[i:i+2]
            if pair in escape_chars:
                result.append(pair)
                i += 2
            else:
                # Skip the backtick, keep the next char
                result.append(script_content[i+1])
                i += 2
        else:
            result.append(script_content[i])
            i += 1
    return ''.join(result)


def resolve_string_concat(script_content):
    """Resolve simple string concatenation patterns."""
    # Pattern: 'str1' + 'str2'
    pattern = re.compile(r"'([^']*)'\s*\+\s*'([^']*)'")
    while pattern.search(script_content):
        script_content = pattern.sub(lambda m: f"'{m.group(1)}{m.group(2)}'",
                                      script_content)
    # Pattern: "str1" + "str2"
    pattern = re.compile(r'"([^"]*)"\s*\+\s*"([^"]*)"')
    while pattern.search(script_content):
        script_content = pattern.sub(lambda m: f'"{m.group(1)}{m.group(2)}"',
                                      script_content)
    return script_content


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <powershell_script>")
        sys.exit(1)

    with open(sys.argv[1], 'r', errors='replace') as f:
        content = f.read()

    print("[+] Obfuscation Analysis")
    print("=" * 60)
    techniques = analyze_obfuscation(content)
    for t in techniques:
        print(f"  - {t}")

    # Attempt automatic deobfuscation
    print("\n[+] Attempting Deobfuscation")
    print("=" * 60)

    # Layer 1: Remove tick marks
    deobfuscated = remove_tick_marks(content)

    # Layer 2: Resolve string concatenation
    deobfuscated = resolve_string_concat(deobfuscated)

    # Layer 3: Decode Base64
    b64_decoded = decode_base64_command(deobfuscated)
    if b64_decoded:
        print("[+] Base64 decoded content:")
        print(b64_decoded[:2000])
        deobfuscated = b64_decoded

    print(f"\n[+] Deobfuscated script length: {len(deobfuscated)} chars")
    output_file = sys.argv[1] + ".deobfuscated.ps1"
    with open(output_file, 'w') as f:
        f.write(deobfuscated)
    print(f"[+] Saved to {output_file}")

Step 2: Multi-Layer IEX Replacement

import subprocess
import tempfile
import os

def iex_replacement_deobfuscate(script_content, max_layers=10):
    """Iteratively replace IEX with Write-Output to unwrap layers."""
    # IEX replacement patterns
    replacements = [
        (r'\bInvoke-Expression\b', 'Write-Output'),
        (r'\bIEX\b', 'Write-Output'),
        (r'\|\s*IEX\b', '| Write-Output'),
    ]

    current = script_content
    layers = []

    for layer_num in range(max_layers):
        # Apply IEX replacements
        modified = current
        for pattern, replacement in replacements:
            modified = re.sub(pattern, replacement, modified, flags=re.IGNORECASE)

        if modified == current and layer_num > 0:
            print(f"  [+] No more IEX layers found at layer {layer_num}")
            break

        # Write to temp file and execute in constrained PowerShell
        with tempfile.NamedTemporaryFile(mode='w', suffix='.ps1',
                                          delete=False) as tmp:
            tmp.write(modified)
            tmp_path = tmp.name

        try:
            result = subprocess.run(
                ['powershell', '-NoProfile', '-ExecutionPolicy', 'Bypass',
                 '-File', tmp_path],
                capture_output=True, text=True, timeout=30
            )

            output = result.stdout.strip()
            if output and output != current:
                print(f"  [+] Layer {layer_num + 1}: Unwrapped "
                      f"{len(output)} chars")
                layers.append({
                    "layer": layer_num + 1,
                    "technique": "IEX replacement",
                    "content_length": len(output),
                })
                current = output
            else:
                break

        except subprocess.TimeoutExpired:
            print(f"  [!] Layer {layer_num + 1}: Execution timeout")
            break
        finally:
            os.unlink(tmp_path)

    return current, layers

Step 3: Extract IOCs from Deobfuscated Script

def extract_iocs_from_script(deobfuscated_content):
    """Extract indicators of compromise from deobfuscated PowerShell."""
    iocs = {
        "urls": [],
        "ips": [],
        "domains": [],
        "file_paths": [],
        "registry_keys": [],
        "commands": [],
        "base64_blobs": [],
    }

    # URLs
    url_pattern = re.compile(
        r'https?://[^\s\'"<>)\]]+', re.IGNORECASE
    )
    iocs["urls"] = list(set(url_pattern.findall(deobfuscated_content)))

    # IP addresses
    ip_pattern = re.compile(
        r'\b(?:\d{1,3}\.){3}\d{1,3}\b'
    )
    iocs["ips"] = list(set(ip_pattern.findall(deobfuscated_content)))

    # File paths
    path_pattern = re.compile(
        r'[A-Za-z]:\\[^\s\'"<>|]+|'
        r'\\\\[^\s\'"<>|]+|'
        r'%(?:APPDATA|TEMP|USERPROFILE|PROGRAMFILES)%[^\s\'"<>|]*',
        re.IGNORECASE
    )
    iocs["file_paths"] = list(set(path_pattern.findall(deobfuscated_content)))

    # Registry keys
    reg_pattern = re.compile(
        r'(?:HKLM|HKCU|HKCR|HKU|HKCC)(?:\\[^\s\'"<>|]+)+',
        re.IGNORECASE
    )
    iocs["registry_keys"] = list(set(reg_pattern.findall(deobfuscated_content)))

    # Suspicious commands
    suspicious_cmds = [
        'New-Object Net.WebClient',
        'DownloadString', 'DownloadFile', 'DownloadData',
        'Start-Process', 'Invoke-WebRequest',
        'New-Object IO.MemoryStream',
        'Reflection.Assembly',
        'Add-MpPreference -ExclusionPath',
        'Set-MpPreference -DisableRealtimeMonitoring',
        'New-ScheduledTask', 'Register-ScheduledTask',
    ]
    for cmd in suspicious_cmds:
        if cmd.lower() in deobfuscated_content.lower():
            iocs["commands"].append(cmd)

    return iocs

Validation Criteria

• All obfuscation layers identified and classified correctly
• Base64 encoded commands decoded to readable PowerShell
• Tick-mark and string concatenation obfuscation resolved
• IEX replacement reveals next-stage payloads
• URLs, IPs, and file paths extracted from final deobfuscated stage
• Deobfuscated script matches observed malware behavior in sandbox

References

• PSDecode - PowerShell Deobfuscation
• PowerDecode - Multi-layer Deobfuscation
• PowerPeeler - Instruction-level Deobfuscation
• SentinelOne - Deconstructing PowerShell Obfuscation
• MITRE ATT&CK T1059.001 - PowerShell

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

PowerShell Deobfuscation Analysis Report

Report Metadata

Field	Value
Report ID	PS-DEOB-YYYY-NNNN
Date	YYYY-MM-DD
Sample Hash (SHA-256)
Original Filename
Classification	TLP:AMBER

Obfuscation Layers Identified

Layer	Technique	Description
1
2
3

Deobfuscation Results

Layer-by-Layer Breakdown

Layer	Input Size	Output Size	Technique Applied
1	bytes	bytes
2	bytes	bytes

Final Deobfuscated Script Summary

• Total layers removed:
• Final script purpose:
• Execution method:

Extracted IOCs

URLs

URL	Purpose
	Payload download / C2

IP Addresses

IP	Context

File System Artifacts

Path	Action
	Created / Modified / Deleted

Registry Keys

Key	Action
	Created / Modified

Behavioral Analysis

• Download behavior:
• Persistence mechanism:
• Evasion techniques:
• Payload type:

MITRE ATT&CK Mapping

Technique	ID	Evidence
PowerShell	T1059.001	Script execution
Obfuscated Files	T1027	Multi-layer encoding

references/api-reference.md (verbatim)

PowerShell Deobfuscation — API Reference

Libraries

Library	Install	Purpose
re	stdlib	Regex pattern matching for obfuscation detection
base64	stdlib	Base64 decoding of encoded commands
pySigma	pip install pySigma	Sigma rule generation for detections

Common Obfuscation Techniques

Technique	Pattern	Example
Base64 Encoding	-EncodedCommand <b64>	powershell -enc SQBFAFgA...
String Concatenation	'str1'+'str2'	'Inv'+'oke'+'-Exp'+'ression'
Character Codes	[char]73+[char]69	[char]73 = I, [char]69 = E
Backtick Escape	`I`E`X	Backtick breaks keyword detection
Variable Substitution	$env:COMSPEC	Use env vars as execution paths
Compression	IO.Compression.DeflateStream	Compressed + Base64 payload

Detection Event IDs

Source	Event ID	Description
PowerShell	4104	Script block logging (deobfuscated content)
Sysmon	1	Process creation with command line
Defender	1116	Malware detection

External References

• Invoke-Obfuscation
• PSDecode
• PowerShell ScriptBlock Logging

references/standards.md (verbatim)

Standards and Frameworks Reference

PowerShell Obfuscation Taxonomy

Layer Classification

Layer	Technique	Example
L1	Base64 EncodedCommand	powershell -enc SQBFAFgA...
L2	String Concatenation	$a='Inv'+'oke'+'-Ex'+'pression'
L3	Character Code Array	[char[]](73,69,88)-join''
L4	Tick-Mark Insertion	I`nv`oke-Exp`ress`ion
L5	Environment Variable	$env:COMSPEC[4,15,25]-join''
L6	SecureString	ConvertTo-SecureString ... -Key
L7	Compression + Base64	IO.Compression.DeflateStream
L8	XOR Encoding	`$bytes
L9	Replace Chain	.Replace('abc','I').Replace(...)
L10	Format String	("{2}{0}{1}" -f 'ke-','Ex','Invo')

MITRE ATT&CK Mappings

Technique	ID	Description
Command and Scripting Interpreter: PowerShell	T1059.001	Malicious PowerShell execution
Obfuscated Files or Information	T1027	Encoding/encryption of scripts
Deobfuscate/Decode Files	T1140	Runtime deobfuscation
Ingress Tool Transfer	T1105	Downloading payloads via PS
System Binary Proxy Execution	T1218	Using trusted binaries

PowerShell AST Node Types for Analysis

Key Expression Nodes

• CommandExpression: Direct command invocations
• InvokeMemberExpression: Method calls on objects
• BinaryExpression: String concatenation operators
• ArrayExpression: Character array construction
• SubExpression: Nested expression evaluation
• ExpandableStringExpression: String interpolation

References

• PowerShell Language Specification
• Invoke-Obfuscation Framework
• AMSI Interface Documentation

references/workflows.md (verbatim)

PowerShell Deobfuscation Workflows

Workflow 1: Automated Multi-Layer Deobfuscation

[Obfuscated Script] --> [Identify Techniques] --> [Remove Tick Marks]
                                                        |
                                                        v
                                              [Resolve Concatenation]
                                                        |
                                                        v
                                              [Decode Base64 Layers]
                                                        |
                                                        v
                                              [IEX -> Write-Output]
                                                        |
                                                        v
                                              [Extract Final Payload]

Workflow 2: AST-Based Analysis

[Script Input] --> [Parse AST] --> [Walk Expression Nodes] --> [Evaluate Expressions]
                                                                       |
                                                                       v
                                                             [Reconstruct Commands]
                                                                       |
                                                                       v
                                                             [Extract IOCs]

Workflow 3: Dynamic Sandbox Deobfuscation

[Obfuscated Script] --> [Execute in Sandbox] --> [Capture ScriptBlock Logs]
                                                          |
                                                          v
                                                 [Event ID 4104 Analysis]
                                                          |
                                                          v
                                                 [Reconstruct Execution Chain]

Steps:

1. Enable Logging: Enable PowerShell ScriptBlock logging (Event ID 4104)
2. Execute: Run obfuscated script in isolated sandbox
3. Collect: Gather all ScriptBlock log entries
4. Reconstruct: Assemble deobfuscated script from logged blocks
5. Extract: Pull IOCs from the reconstructed clear-text script

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.