Skip to content
Get packs

Guide · Agent skill

How to use the PowerShell Empire Artifact Analyzer agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the analyzing-powershell-empire-artifacts agent skill, which teaches an AI agent to search Windows PowerShell event logs for traces of the PowerShell Empire post-exploitation framework. It is aimed at security analysts, threat hunters and students who have not used agent skills before. By the end you will know what the skill does, how to add it to your agent, how to phrase requests so it triggers, and what limits to keep in mind.

PowerShell Empire Artifact Analyzermukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Download the skill ZIP from this page and unzip it. The folder should be named analyzing-powershell-empire-artifacts.
  2. 2Place the folder. Move it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. You can also upload it under Settings → Capabilities → Skills in the Claude apps.
  3. 3Confirm logging is enabled. Check that Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) are enabled through Group Policy on the systems you will examine.
  4. 4Prepare your logs. Make sure you have access to the Windows Event Log or exported EVTX files, and that Python 3.9 or newer is installed.
  5. 5Ask a specific question. Request a hunt in plain language, naming the log source and the indicators you care about, such as launcher strings or Invoke-Mimikatz.
  6. 6Review the report. Check the matched indicators, decoded payloads, timeline and ATT&CK mappings, and verify each hit against context to rule out legitimate admin scripts.

What the skill makes the agent do

An agent skill is a folder of instructions and supporting files that an AI agent loads when a task matches the skill's description. This one covers hunting for PowerShell Empire activity in Windows logs. It focuses on Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103).

The skill looks for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Base64-encoded payloads containing System.Net.WebClient or FromBase64String, known module names such as Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation, Invoke-PSInject and Invoke-DCOM, and default staging URL patterns such as /login/process.php and /admin/get.php.

  • Output is a JSON report with matched indicators, decoded Base64 payloads, a timeline of suspicious events, MITRE ATT&CK technique mappings and severity scores.
  • The skill's files are SKILL.md, scripts/agent.py and references/api-reference.md.

Install the skill from the ZIP download

Download the ZIP for this skill from this page. Unzip it so the folder analyzing-powershell-empire-artifacts sits in one of these locations:

For a personal install, put it in ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder. Alternatively, in the Claude apps, open Settings → Capabilities → Skills and upload the skill there.

  • Personal: ~/.claude/skills/analyzing-powershell-empire-artifacts/
  • Project: .claude/skills/analyzing-powershell-empire-artifacts/
  • Claude apps: Settings → Capabilities → Skills, then upload

Check the requirements before you start

The skill needs Python 3.9 or newer and access to either the live Windows Event Log or exported EVTX files. The logs are only useful if the right logging was on before the activity happened, so confirm the policies are set.

Enable Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) through Group Policy. The reference file documents the GPO paths and the registry value EnableScriptBlockLogging set to 1. The skill also uses Python standard library modules, and its script imports subprocess, which may call external tools.

  • Python 3.9 or newer
  • Access to the Windows Event Log or exported EVTX files
  • Script Block Logging enabled via Group Policy (Event ID 4104)
  • Module Logging enabled via Group Policy (Event ID 4103), with Module Names set to *
Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging: Enabled

Trigger the skill with natural requests

You do not need a special command. Ask the agent in plain language about Empire, Event ID 4104 or the artifacts you want to check. The skill's description covers hunting for or confirming Empire C2 activity in Windows event logs, so requests that match that wording are the most likely to load it.

Name the log source and the question you want answered. Specific requests give better matches than generic ones such as 'check my logs'.

  • Check these exported EVTX files for PowerShell Empire launcher strings and give me a timeline.
  • Search Event ID 4104 for Base64 payloads that use WebClient or FromBase64String and decode them.
  • Look for Invoke-Mimikatz or Invoke-Kerberoast invocations in the PowerShell Operational log and map them to MITRE ATT&CK.
  • Confirm whether there is any Empire C2 activity in this Windows event log export.

Read the output with its limits in mind

Treat the report as a list of leads. Many signatures, such as IEX, Invoke-Expression and WebClient, also appear in legitimate administrator scripts, so each match needs review in context. The patterns are fixed and an attacker can change them, so a clean result does not prove that Empire was absent.

Because the skill processes sensitive forensic data, run it only on systems you are authorized to examine and follow your organization's log-handling procedures.

  • Expect false positives from administrative scripts.
  • A missing match is not proof of absence; the skill does not cover other C2 frameworks.
  • Use it on authorized systems and exported copies where appropriate.

What people use it for

  • Confirming whether an exported EVTX file contains Empire default launcher strings during incident response.
  • Decoding Base64 PowerShell payloads found in Event ID 4104 records to see what a stager tried to download.
  • Building a timeline of suspicious PowerShell events across a log export.
  • Testing whether a threat hunting query catches known Empire module names such as Invoke-Kerberoast.
  • Teaching students how post-exploitation frameworks leave traces in Windows PowerShell logs.

Frequently asked questions

Is the PowerShell Empire Artifact Analyzer skill free?

The skill is published under the Apache-2.0 licence, as listed on this page. Check the licence file in the download for the full terms before using it in your work.

What do I need to run the analyzing-powershell-empire-artifacts skill?

You need Python 3.9 or newer, access to the Windows Event Log or exported EVTX files, and Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) enabled through Group Policy. The skill runs scripts but does not use the network.

Where do I install an agent skill like this one?

Unzip the folder into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps you can instead upload it under Settings → Capabilities → Skills.

Why does my scan flag normal PowerShell scripts?

Signatures such as IEX, Invoke-Expression and WebClient also appear in legitimate admin scripts, so they produce false positives. Review each match in context before treating it as malicious.

Does this skill detect other C2 frameworks like Cobalt Strike?

No. The skill is limited to PowerShell Empire artifacts and does not cover other C2 frameworks. Use dedicated tooling for those.

Why is no Empire activity found in my logs?

The skill depends on Script Block Logging and Module Logging being enabled before the activity occurred. Its patterns are also fixed and easy for attackers to change, so a clean result does not prove Empire was absent.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits SOC analysts, incident responders, threat hunters and students who need a structured way to look for PowerShell Empire traces in Windows logs. It is not a general PowerShell troubleshooting tool, and it is not a complete detector, so anyone who needs coverage of other frameworks or a guarantee of detection should choose something else.

Download the skill