analyzing-powershell-empire-artifacts

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.

Quality

82%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Quality

Content

65%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and well-sectioned with concrete IOC indicators, but it stops short of executable guidance: it never invokes the bundled script or points to the reference file, and presents no sequenced detection workflow with validation. Tying the overview to the bundle files would lift the weaker dimensions.

Suggestions

Add a Quick-start step showing an executable command, e.g. `python scripts/agent.py scan-logs` and `python scripts/agent.py analyze-file <path>`, so the body is copy-paste actionable.

Reference the bundle explicitly — e.g. 'Full IOC tables and Splunk/Elastic queries: see references/api-reference.md' — so progressive disclosure is signaled and inline IOC duplication is reduced.

Present the detection task as a short numbered workflow (enable logging -> query 4104/4103 -> analyze -> validate decoded payload -> report) with a validation checkpoint before reporting findings.

Dimension	Reasoning	Score
Conciseness	The body is lean (~30 lines), assumes Claude's competence, and avoids explaining concepts Claude already knows; the one orienting overview sentence and concise IOC lists earn their place with only minor overlap with the description.	3 / 3
Actionability	The body lists concrete IOC strings but provides no executable code or commands in-skill — it never shows how to run scripts/agent.py or a detection query — so guidance is concrete in indicator content but not copy-paste executable.	2 / 3
Workflow Clarity	The detection task (enable logging, query, analyze, report) is implicitly ordered via section flow but is never presented as a sequenced workflow, and there are no validation checkpoints despite batch scanning of event logs.	2 / 3
Progressive Disclosure	Bundle files (references/api-reference.md, scripts/agent.py) exist but are never referenced or signaled from the body, and IOC patterns are duplicated inline that belong in the reference — structure is clean but navigation to bundle content is missing.	2 / 3
	Total	9 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific, third-person description that clearly states what it detects and gives an explicit Use-when trigger for Empire C2 hunting. It distinguishes itself well via framework-specific indicators.

Dimension	Reasoning	Score
Specificity	The description enumerates multiple concrete detection actions and artifact types — default launcher string, Base64-encoded WebClient/FromBase64String payloads, named module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns — matching the anchor that lists multiple specific concrete actions.	3 / 3
Completeness	It explicitly answers both what (detect Empire artifacts in 4104/4103 logs) and when via an explicit 'Use when hunting for or confirming Empire C2 activity in Windows event logs' clause.	3 / 3
Trigger Term Quality	It includes natural terms a threat hunter or SOC analyst would actually say — 'PowerShell Empire', 'C2 activity', 'hunting for or confirming', 'Windows event logs' — giving good coverage rather than only technical jargon.	3 / 3
Distinctiveness Conflict Risk	It is scoped narrowly to the PowerShell Empire framework with framework-specific triggers (Empire launcher, Empire module names, Empire staging URIs), making it unlikely to fire for unrelated PowerShell or threat-hunting skills.	3 / 3
	Total	12 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-powershell-empire-artifacts/SKILL.md
Commit: e612f49

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.