Feature Request: Add Static PowerShell Malware Deobfuscation Operations

Hello,

I hope you are doing well.

I would like to respectfully suggest a feature improvement for CyberChef related to PowerShell malware deobfuscation.

CyberChef is already an extremely useful tool for decoding and transforming suspicious data, especially for tasks such as Base64 decoding, compression handling, string extraction, and URL extraction. However, when analyzing real-world obfuscated PowerShell malware, analysts often need to manually repeat several steps or use external tools to fully deobfuscate the script.

It would be very helpful if CyberChef could include a more complete PowerShell deobfuscation module or recipe group, inspired by existing tools and methodologies such as:

* PSDecode
https://github.com/r3mrum/psdecode

* PowerDecode
https://github.com/Malandrone/PowerDecode

* Deobfuscating PowerShell Obfuscated Malware skill
https://lobehub.com/skills/mukul975-anthropic-cybersecurity-skills-deobfuscating-powershell-obfuscated-malware

* PowerShell Malware Deobfuscator
https://mcpmarket.com/tools/skills/powershell-malware-deobfuscator

A useful CyberChef update could include capabilities such as:

* Detecting and decoding PowerShell EncodedCommand values
* Handling UTF-16LE Base64 PowerShell payloads
* Removing PowerShell backtick obfuscation
* Rebuilding concatenated strings, such as `'In'+'v'+'ok'+'e-Item'`
* Resolving simple character expressions such as `[char]42`
* Extracting URLs, domains, IP addresses, file paths, and C2 indicators
* Detecting common PowerShell execution patterns such as `IEX`, `Invoke-Expression`, `DownloadFile`, `Start-Process`, and `Invoke-Item`
* Supporting common compression layers such as Deflate and GZIP
* Producing a readable deobfuscated output and a summary of extracted indicators
* Keeping the analysis static and safe by default, without executing the suspicious script

This would make CyberChef even more valuable for blue team analysts, DFIR investigators, malware analysts, and students who are learning how to safely analyze obfuscated PowerShell samples.

I completely understand that implementing this properly may require careful design, especially to avoid unsafe execution of malicious scripts. A static-first approach would be ideal, with clear warnings if any optional dynamic analysis feature is ever considered.

Thank you very much for your time and for maintaining such a useful tool. I would be grateful if you could consider this feature idea for a future CyberChef update.

Best regards,

The issue names no CyberChef files, tests, or entry points; start by locating the existing operation and recipe structure for static transformations. Done would require a clearly scoped static PowerShell capability covering the selected decoding, deobfuscation, indicator extraction, and safe readable output, with verification defined for that scope.

Written by the indexing model from the issue text.