Machine learning from idea to reality: a PowerShell case study

This blog post presents a case study by RIFT on detecting offensive and obfuscated PowerShell scripts using Windows Event Log 4104: it describes dataset construction (malicious scripts from GitHub, obfuscation datasets, and benign scripts), feature engineering based on token and character percentages, Random Forest models for obfuscation and offensive-script detection, evaluation results, and integration into Splunk for real-time detection; the authors recommend enabling PowerShell logging and iteratively improving the models for operational use.