PowerShell Empire Artifact Analyzer
Hunts Windows event logs for signs of PowerShell Empire attack-framework activity
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
This skill teaches an AI agent how to search Windows PowerShell event logs (Script Block Logging Event ID 4104 and Module Logging Event ID 4103) for traces of PowerShell Empire, a post-exploitation hacking framework. It looks for its default launcher string, Base64-encoded download payloads, names of well-known attack modules such as Invoke-Mimikatz and Invoke-Kerberoast, and default staging URLs. The agent can then produce a structured report with matched indicators, decoded payloads, a timeline and MITRE ATT&CK mappings.
Great for
- Security analysts (SOC or incident response) checking Windows logs for Empire activity
- Threat hunters writing or testing detection queries
- Students learning how post-exploitation frameworks leave traces in logs
Skip it if
- General PowerShell troubleshooting or script review, since many signatures (IEX, Invoke-Expression, WebClient) also match legitimate admin scripts and will produce false positives
- Anyone expecting complete detection: the patterns are fixed and easy for attackers to change, and the skill does not cover other C2 frameworks
- Running against live production systems without authorization or proper log-handling procedures, because it processes sensitive forensic data
Try asking
- “Scan this exported Security.evtx file for PowerShell Empire launcher strings and Base64 payloads”
- “Decode the suspicious Event ID 4104 blocks and list which Invoke-Mimikatz or Invoke-Kerberoast calls appear”
- “Build a timeline of suspicious PowerShell events on this host and map them to MITRE ATT&CK techniques”
- “Check these logs for default Empire staging URLs like /admin/get.php”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-powershell-empire-artifacts.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-powershell-empire-artifacts.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-powershell-empire-artifacts.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Review scripts/agent.py before running it, especially the subprocess calls, and run it first on a copy of the logs rather than live systems
- Treat hits on generic terms like IEX or Invoke-Expression as leads to verify, not confirmed compromise, and check for legitimate admin tooling
- Confirm that Script Block Logging is enabled before relying on the results, since missing logs look like a clean system
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.