PowerShell Script Block Analysis
FreeAnalyze PowerShell logs to detect obfuscation and threats.
Free · Opens the source repo
What PowerShell Script Block Analysis does
The Analyzing PowerShell Script Block Logging skill is designed for security professionals who need to investigate PowerShell activities on Windows systems. This skill specifically targets Event ID 4104 from PowerShell Operational logs, which records the execution of PowerShell scripts. By leveraging the python-evtx library, it extracts and reconstructs script blocks, enabling users to analyze potentially malicious commands and techniques used to evade detection.
This skill employs advanced detection heuristics to identify common obfuscation tactics, such as Base64-encoded commands and download cradles. It also looks for patterns indicative of living-off-the-land techniques, where attackers use legitimate tools for malicious purposes. By analyzing the entropy of script blocks and applying pattern matching, users can effectively uncover hidden threats and ensure their security monitoring is robust against various attack vectors.
The skill is particularly useful for Security Operations Center (SOC) analysts and incident responders who require structured procedures for analyzing PowerShell logs. It aids in building detection rules and threat hunting queries, making it a valuable addition to any cybersecurity toolkit. Additionally, the generated reports include risk scores and mapping to the MITRE ATT&CK framework, providing context for the identified threats and facilitating response actions.
To use this skill, users need a basic understanding of security operations and access to a suitable environment for testing. The setup process is straightforward, requiring the installation of dependencies and the collection of relevant logs. Once configured, users can execute the provided Python script to parse the logs and generate detailed analysis reports.
When to use it
Use this skill when investigating security incidents involving PowerShell or when developing detection mechanisms for PowerShell-related threats.
When not to use it
This skill is not suitable for general-purpose scripting or non-security-related PowerShell tasks.
What you can build with it
Incident Investigation
Use this skill to analyze PowerShell logs during a security incident to identify potentially malicious commands.
Detection Rule Development
Leverage the skill to create detection rules for common PowerShell obfuscation techniques in your security monitoring tools.
Threat Hunting
Employ this skill for proactive threat hunting, looking for signs of malicious PowerShell usage in your environment.
How to install PowerShell Script Block Analysis
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-powershell-script-block-logging --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing PowerShell Script Block Logging
When to Use
- When investigating security incidents that require analyzing powershell script block logging
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Familiarity with security operations concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Instructions
- Install dependencies:
pip install python-evtx lxml - Collect PowerShell Operational logs:
Microsoft-Windows-PowerShell%4Operational.evtx - Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber/MessageTotal for multi-part script reconstruction.
- Apply detection heuristics:
- Base64-encoded commands (
-EncodedCommand,FromBase64String) - Download cradles (
DownloadString,DownloadFile,Invoke-WebRequest,Net.WebClient) - AMSI bypass patterns (
AmsiUtils,amsiInitFailed) - Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)
- Base64-encoded commands (
- Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.
python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json
Examples
Detect Encoded Command Execution
import base64
if "-encodedcommand" in script_text.lower():
encoded = script_text.split()[-1]
decoded = base64.b64decode(encoded).decode("utf-16-le")
Reconstruct Multi-Block Script
Scripts split across multiple 4104 events share a ScriptBlockId. Concatenate blocks ordered by MessageNumber to recover the full script.
Frequently asked questions about PowerShell Script Block Analysis
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.