Skill

analyzing-powershell-empire-artifacts

From asi

Detects PowerShell Empire artifacts in Windows event logs via Base64 launcher patterns, stager IOCs, module signatures, user agents, and staging URLs in Script Block Logging. For threat hunting and forensics.

Powershell

Python

security

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (`powershell -noP -sta -w 1 -enc`), Base64 encoded payloads containing `Sy...

SKILL.md

Similar Skills

analyzing-powershell-empire-artifacts

5.9k

Detects PowerShell Empire artifacts in Windows event logs via Base64 launchers, stager IOCs, module signatures, user agents, and staging URLs in Script Block Logging.

3 files

cybersecurity-skills

analyzing-powershell-empire-artifacts

Detects PowerShell Empire artifacts in Windows event logs (4103/4104) via Base64 stagers, module signatures like Invoke-Mimikatz, User-Agents, and C2 URLs. Outputs JSON with IOCs, timelines, MITRE mappings for threat hunting.

3 files

cybersecurity-skills-zh

hunting-for-anomalous-powershell-execution

Parses Windows EVTX files for malicious PowerShell via Event 4104/4103 logs, detecting AMSI bypasses, obfuscated commands, encoded payloads, credential dumping, and download cradles. For threat hunting and incident analysis.

asi

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Analyzing PowerShell Empire Artifacts

Overview

PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Base64 encoded payloads containing System.Net.WebClient and FromBase64String, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation), and staging URL patterns.

When to Use

When investigating security incidents that require analyzing powershell empire artifacts

When building detection rules or threat hunting queries for this domain

When SOC analysts need structured procedures for this analysis type

When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with access to Windows Event Log or exported EVTX files

PowerShell Script Block Logging (Event ID 4104) enabled via Group Policy

Module Logging (Event ID 4103) enabled for comprehensive coverage

Key Detection Patterns

Default launcher — powershell -noP -sta -w 1 -enc followed by Base64 blob

Stager indicators — System.Net.WebClient, DownloadData, DownloadString, FromBase64String

Module signatures — Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation, Invoke-PSInject, Invoke-DCOM

User agent strings — default Empire user agents in HTTP listener configuration

Staging URLs — /login/process.php, /admin/get.php and similar default URI patterns

Output

JSON report with matched IOCs, decoded Base64 payloads, timeline of suspicious events, MITRE ATT&CK technique mappings, and severity scores.