<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Malicious PowerShell Execution

## Commands

| Command | Description |
|---|---|
| `Get-WinEvent -LogName PowerShell/Operational` | Query PowerShell operational log |
| `Get-WinEvent -FilterHashtable @{Id=4104}` | Get Script Block Logging events |
| `Get-WinEvent -FilterHashtable @{Id=4103}` | Get Module Logging events |
| `Get-MpThreatDetection` | Get AMSI detections |
| `Get-ExecutionPolicy` | Check PowerShell execution policy |
| `Get-PSReadLineOption` | Check PSReadLine history config |
| `Get-ItemProperty HKLM:...PowerShell` | Check GPO logging settings |

## Agent Script

```bash
# node agent.js analyze --script <value>
# node agent.js check-logging --hostname <value>
# node agent.js decode --encoded <value>
```
