Skip to content
Get packs

Guide · Agent skill

How to use the PowerShell Script Block Log Analysis agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill for Claude that lets the agent analyze exported Windows PowerShell logs. It reads Script Block Logging events (Event ID 4104) from .evtx files, reconstructs scripts split across several entries, and flags suspicious patterns for a security analyst to review. This guide covers what the skill does, how to install it, how to ask for it in plain language, and the limits you should keep in mind.

PowerShell Script Block Log Analysismukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page and unzip it.
  2. 2Place the folder. Put the analyzing-powershell-script-block-logging folder in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder.
  3. 3Install dependencies. Run pip install python-evtx lxml with Python 3.8 or newer.
  4. 4Prepare the log. Export the Microsoft-Windows-PowerShell%4Operational.evtx file from the endpoint, working on a copy.
  5. 5Ask in plain language. Tell the agent which log to analyze and what you want back, such as flagged patterns or a JSON report.
  6. 6Review the report. Check reconstructed scripts and flagged items yourself before drawing conclusions.

What the skill makes the agent do

Agent skills are folders of instructions and scripts that an AI agent loads when a task matches them. This one is built for Windows endpoint investigation. Once installed, the agent can read a Windows PowerShell Operational .evtx log file and pull out the script text PowerShell recorded.

It rebuilds scripts that were split across several log entries by grouping blocks that share a ScriptBlockId and ordering them by MessageNumber. It then checks for suspicious patterns: Base64-encoded commands, download cradles, AMSI bypass attempts, and obfuscation indicators such as high entropy, tick-mark insertion and string concatenation. The output is a JSON report with risk scores and MITRE ATT&CK technique mappings (T1059.001, T1027.010, T1140, T1105).

  • Extracts ScriptBlockText, ScriptBlockId and MessageNumber/MessageTotal from Event ID 4104
  • Reconstructs multi-part scripts
  • Flags encoded commands (-EncodedCommand, FromBase64String)
  • Flags download cradles (DownloadString, DownloadFile, Invoke-WebRequest, Net.WebClient)
  • Flags AMSI bypass patterns (AmsiUtils, amsiInitFailed)
  • Writes a JSON report for analyst review

Install the skill from a ZIP file

Download the ZIP for this skill from this page and unzip it. You have two places to put the folder. For a personal install available across projects, place the skill folder inside ~/.claude/skills/. For a single project, place it inside that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

  • Personal: ~/.claude/skills/analyzing-powershell-script-block-logging/
  • Project: .claude/skills/analyzing-powershell-script-block-logging/ inside your project

Install the Python dependencies

The scripts need Python 3.8 or newer, the python-evtx library and lxml. The skill's own instructions give this command for the dependencies.

pip install python-evtx lxml

Get a PowerShell log file with Script Block Logging

The skill needs a Microsoft-Windows-PowerShell%4Operational.evtx file that contains Event ID 4104 records, which means Script Block Logging was enabled on the machine when the activity happened. Export the Windows PowerShell Operational log from the affected endpoint and copy it to the machine where you run the agent.

Analyze copies, not originals, and follow your organisation's evidence-handling rules. The skill does not describe chain-of-custody steps.

Trigger the skill with natural requests

You do not need to name scripts or flags. Describe the task and point at the file. The agent matches your request to the skill's description and follows its procedure. Good requests name the log, the goal and the output you want.

If you want to run the script yourself, the skill's instructions give this command, with the path replaced by your file:

  • Analyze C:\Logs\PowerShell-Operational.evtx for encoded PowerShell commands and reconstruct any split scripts.
  • Parse the 4104 events in this EVTX file and list download cradles or AMSI bypass attempts.
  • Triage this PowerShell log for an incident review and give me a JSON report with risk levels and MITRE ATT&CK mappings.
python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json

Read the output carefully

The report is a starting point. Heuristic regex and entropy matches can produce false positives and false negatives, so a person must check each flagged script before drawing conclusions. The skill is designed for analysts reviewing logs after the fact, not for blocking anything live.

The skill's examples show the decoding logic for encoded commands: it takes the last token after -EncodedCommand, decodes it from Base64 and reads the result as UTF-16 little-endian text.

  • Check the reconstructed script text before trusting a risk score
  • Compare flagged items against what you know about the machine's normal activity
  • Record your own conclusions separately from the tool's output

What people use it for

  • Triage a suspected incident by finding encoded PowerShell commands in an endpoint's PowerShell log
  • Recover full scripts that were split across several Event ID 4104 entries
  • Spot download cradles and AMSI bypass strings during a threat hunt
  • Learn how PowerShell attacks look in log form as a security student
  • Produce a first-pass JSON report with MITRE ATT&CK mappings for analyst review

Frequently asked questions

How do I install the PowerShell script block log analysis skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings, then Capabilities, then Skills. Install the Python dependencies with pip install python-evtx lxml.

What do I need to run it?

You need Python 3.8 or newer, python-evtx, lxml, and a Windows PowerShell Operational .evtx log that has Script Block Logging events (Event ID 4104). The skill works only on these Windows log files.

Is the skill free to use?

The source lists the licence as Apache-2.0. Check the licence file in the repository for the full terms. This page does not state pricing.

Does it block malicious PowerShell in real time?

No. It analyzes exported log files after the fact and does not prevent or block anything live.

Why does it show false positives?

Its detections rely on regex patterns and entropy heuristics, which can flag benign scripts and miss obfuscated ones. Every flagged item needs review by an analyst.

Does the skill need internet access?

The source states it does not use the network. It runs scripts locally against the log file you provide, though the scripts do execute on your machine.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits SOC analysts triaging Windows PowerShell logs after an incident, security students learning how PowerShell attacks appear in logs, and threat hunters wanting a first-pass review. It is not suited to live prevention, to forensic evidence handling without expert review, or to non-Windows environments.

Download the skill