PowerShell Script Block Log Analysis
Scans Windows PowerShell Event 4104 logs for obfuscated, encoded, and attack-style scripts
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can read Windows PowerShell logging files (.evtx) that record the script code PowerShell ran. It pulls out the recorded script text, rebuilds scripts that were split across several log entries, and flags suspicious patterns such as encoded commands, download commands, and attempts to disable Windows security scanning. It then produces a JSON report with risk levels and MITRE ATT&CK technique mappings for a security analyst to review.
Great for
- SOC analysts reviewing Windows endpoint logs after a suspected incident
- Security students learning how PowerShell attacks appear in logs
- Threat hunters who want a first-pass triage of PowerShell activity
Skip it if
- Live blocking or prevention, because it only analyzes exported log files after the fact
- Production forensic evidence handling without review, since heuristic regex matches can produce false positives and negatives and the skill does not describe chain-of-custody steps
- Non-Windows environments, since the input is Windows-specific EVTX logs
Try asking
- “Analyze this PowerShell-Operational.evtx file and list any encoded commands or download cradles”
- “Rebuild the full scripts from the multi-part Event 4104 blocks in this log export”
- “Scan these Windows PowerShell logs for AMSI bypass attempts and map findings to MITRE ATT&CK”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-powershell-script-block-logging.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-powershell-script-block-logging.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-powershell-script-block-logging.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run it against exported log copies in a lab or working folder, not against production logs you have not authorized to process
- Treat the risk scores as triage hints and verify flagged scripts manually before drawing conclusions
- Check the script's own argument and output paths before running it, since it executes local Python code
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.