Analyzing PowerShell Empire Artifacts
FreeDetect and analyze PowerShell Empire traces in event logs.
Free · Opens the source repo
What Analyzing PowerShell Empire Artifacts does
This skill provides a structured approach to detect and analyze artifacts left by the PowerShell Empire post-exploitation framework. It focuses on identifying traces in Windows event logs, specifically through PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). By analyzing these logs, users can uncover critical indicators of compromise (IOCs) related to PowerShell Empire, including the default launcher string, Base64-encoded payloads, and known module invocations such as Invoke-Mimikatz and Invoke-Kerberoast.
The skill is designed for security analysts and incident responders who need to investigate potential security incidents involving PowerShell Empire. It can be particularly useful for building detection rules, threat hunting queries, and validating security monitoring coverage for relevant attack techniques. The output is a comprehensive JSON report that includes matched IOCs, decoded Base64 payloads, a timeline of suspicious events, and mappings to MITRE ATT&CK techniques, which can aid in understanding the severity of the detected activities.
To use this skill effectively, users must have Python 3.9 or higher and ensure that both PowerShell Script Block Logging and Module Logging are enabled in their environment. This setup allows for comprehensive coverage of potential Empire C2 activity and enhances the ability to respond to security threats in a timely manner. The skill is a valuable addition to any security operations center (SOC) toolkit, providing structured procedures for analyzing PowerShell Empire artifacts.
When to use it
Use this skill when investigating incidents related to PowerShell Empire or when building detection capabilities for such threats.
When not to use it
This skill is not suitable for environments without PowerShell logging enabled or for analyzing logs from non-Windows systems.
What you can build with it
Incident Investigation
Use this skill to analyze Windows event logs when investigating potential security incidents involving PowerShell Empire.
Building Detection Rules
Leverage the skill to create detection rules and threat hunting queries focused on PowerShell Empire artifacts.
SOC Analysis Procedures
Implement this skill in SOC workflows to provide structured procedures for analyzing PowerShell Empire activity.
How to install Analyzing PowerShell Empire Artifacts
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-powershell-empire-artifacts --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing PowerShell Empire Artifacts
Overview
PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Base64 encoded payloads containing System.Net.WebClient and FromBase64String, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation), and staging URL patterns.
When to Use
- When investigating security incidents that require analyzing powershell empire artifacts
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with access to Windows Event Log or exported EVTX files
- PowerShell Script Block Logging (Event ID 4104) enabled via Group Policy
- Module Logging (Event ID 4103) enabled for comprehensive coverage
Key Detection Patterns
- Default launcher —
powershell -noP -sta -w 1 -encfollowed by Base64 blob - Stager indicators —
System.Net.WebClient,DownloadData,DownloadString,FromBase64String - Module signatures — Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation, Invoke-PSInject, Invoke-DCOM
- User agent strings — default Empire user agents in HTTP listener configuration
- Staging URLs —
/login/process.php,/admin/get.phpand similar default URI patterns
Output
JSON report with matched IOCs, decoded Base64 payloads, timeline of suspicious events, MITRE ATT&CK technique mappings, and severity scores.
Frequently asked questions about Analyzing PowerShell Empire Artifacts
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.