analyzing-powershell-script-block-logging

Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

High

Do not use without reviewing

Fix and improve this skill with Tessl

tessl review fix ./skills/analyzing-powershell-script-block-logging/SKILL.md

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, actionable skill body with a clear workflow, weakened by missing validation checkpoints in a batch forensic operation and an unreferenced bundle file that breaks navigation.

Suggestions

Add validation checkpoints to the workflow (e.g., confirm EVTX parsed without errors, verify multi-block ScriptBlockId reconstruction is complete, validate the output JSON before reporting).

Link references/api-reference.md from the body (e.g., under an 'API reference' section) so the bundled detail is discoverable.

Replace the incomplete Python snippet with a self-contained, runnable example or label it explicitly as a fragment.

Dimension	Reasoning	Score
Conciseness	The body is lean and does not explain concepts Claude already knows, though the templated 'When to Use' bullets ('When investigating security incidents that require analyzing powershell script block logging') are slightly redundant and could be trimmed.	4 / 5
Actionability	Provides executable commands (`pip install python-evtx lxml`, the `python scripts/agent.py --evtx-file ... --output ...` invocation) and concrete detection patterns, but the first Python example is a fragment with an undefined `script_text` variable.	4 / 5
Workflow Clarity	A clear 5-step sequence is present (install, collect, parse, apply heuristics, report), but this batch EVTX-analysis workflow has no validation or verification checkpoints, so workflow clarity is capped at 3 per the rubric.	3 / 5
Progressive Disclosure	The short body is well organized into sections and bulk API detail is correctly kept in references/api-reference.md, but that file is never linked or signaled from the body, matching the 'references present but not clearly signaled' anchor.	3 / 5
	Total	14 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A highly specific, third-person description with strong capability coverage and low conflict risk, but it omits any explicit 'when to use' trigger guidance, capping completeness.

Suggestions

Add a 'Use when ...' clause naming concrete triggers (e.g., 'Use when analyzing PowerShell Operational EVTX logs, hunting obfuscated or encoded PowerShell, or investigating suspicious script block activity').

Soften jargon with a few plainer synonyms ('PowerShell logs', 'base64 commands') to broaden natural trigger matching.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions—'Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files', 'reconstruct multi-block scripts', 'entropy analysis and pattern matching', and named detections for base64, IEX, download cradles, and AMSI bypass—giving comprehensive coverage.	5 / 5
Completeness	The 'what' is detailed and concrete, but there is no 'Use when...' clause or equivalent explicit trigger guidance, so completeness is capped at 3 per the rubric guideline.	3 / 5
Trigger Term Quality	Includes natural terms a SOC user would say ('PowerShell', 'EVTX', 'obfuscated commands', 'download cradles', 'AMSI bypass') but the phrasing is jargon-heavy and misses a few common synonyms or the plain phrase 'PowerShell logs'.	4 / 5
Distinctiveness Conflict Risk	The narrow niche—PowerShell Script Block Logging Event ID 4104 from EVTX files with named detection heuristics—has distinct triggers and minimal overlap with other skills.	5 / 5
	Total	17 / 20 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: mukul975/Anthropic-Cybersecurity-Skills
Path: skills/analyzing-powershell-script-block-logging/SKILL.md
Commit: 9429fe9

Reviewed: 2 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.