analyzing-powershell-script-block-logging
by mukul975analyzing-powershell-script-block-logging skill for parsing Windows PowerShell Script Block Logging Event ID 4104 from EVTX files, reconstructing split script blocks, and flagging obfuscated commands, encoded payloads, Invoke-Expression abuse, download cradles, and AMSI bypass attempts for Security Audit work.
This skill scores 78/100, which means it is a solid listing candidate for directory users who need a focused PowerShell Script Block Logging analysis workflow. It is specific enough to reduce guesswork versus a generic prompt, with clear event/log targets and detection goals, though the install decision should account for some missing operational polish and onboarding details.
- The skill is tightly scoped to PowerShell Event ID 4104 analysis and states concrete detection goals like obfuscation, encoded commands, IEX abuse, download cradles, and AMSI bypass attempts.
- It includes practical workflow evidence: EVTX parsing with python-evtx, reconstruction of split script blocks, and reference material for XML structure and detection patterns.
- The script file and reference docs indicate real implementation support rather than a placeholder-only skill.
- No install command is provided in SKILL.md, so users may need to infer setup steps and dependencies from the instructions and script.
- The repository evidence shows limited progressive disclosure and few constraints; users doing broader SOC automation or non-Windows log analysis may need to adapt it.
Overview of analyzing-powershell-script-block-logging skill
What this skill does
The analyzing-powershell-script-block-logging skill helps you parse Windows PowerShell Script Block Logging events (Event ID 4104) from EVTX files, reconstruct split script blocks, and flag common malicious patterns such as -EncodedCommand, Invoke-Expression, download cradles, AMSI bypass attempts, and other living-off-the-land techniques.
Who should use it
It is a strong fit for SOC analysts, threat hunters, DFIR practitioners, and anyone doing a Security Audit of Windows endpoints or server logs. If you need a repeatable way to review PowerShell activity from telemetry rather than guess from a single command line, this skill is useful.
Why it is different
The analyzing-powershell-script-block-logging skill is not just a generic “inspect logs” prompt. It is built around Event 4104 structure, multi-part reconstruction, and detection-oriented heuristics from the repo’s script and reference material. That makes it more practical for incident triage than a broad PowerShell analysis prompt.
How to Use analyzing-powershell-script-block-logging skill
Install and locate the core files
Install with:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-powershell-script-block-logging
For the fastest on-ramp, read skills/analyzing-powershell-script-block-logging/SKILL.md first, then references/api-reference.md, then scripts/agent.py. Those three files show the expected log structure, parsing approach, and detection logic.
Give the skill the right input
This skill works best when you provide: the EVTX source, the incident context, the time window, and what you want to decide. A weak request is “analyze this log.” A stronger prompt is: “Use analyzing-powershell-script-block-logging on Microsoft-Windows-PowerShell%4Operational.evtx from 2024-01-15 10:00–11:00 UTC and identify any Event ID 4104 entries with obfuscation, encoded payloads, or downloader behavior.”
Use a workflow that matches the repo
Start by confirming Event 4104 is present, then reconstruct any multi-part ScriptBlockId groups, then review suspicious patterns and tie findings back to the original ScriptBlockText. If you are doing an analyzing-powershell-script-block-logging usage workflow for Security Audit, ask for both detections and coverage gaps: what was flagged, what was not, and which commands need manual review.
Read the reference material in order
references/api-reference.md is the best place to understand field names such as ScriptBlockText, ScriptBlockId, MessageNumber, and MessageTotal. scripts/agent.py is useful for seeing the actual pattern set, confidence logic, and what kinds of PowerShell behaviors the skill treats as high-risk.
analyzing-powershell-script-block-logging skill FAQ
Is this only for incident response?
No. It also fits baseline hardening work, detection engineering, and control validation. If your goal is to understand how PowerShell telemetry supports detection, the analyzing-powershell-script-block-logging guide can still help even without an active incident.
Can I use it as a normal prompt instead of a skill?
You can, but you will usually get less consistent output. The skill gives you a structured path for parsing Event 4104 data, reconstructing split blocks, and checking against known suspicious patterns, which is more reliable than asking a general model to “look for malicious PowerShell.”
What are the main limits?
It depends on Script Block Logging being enabled and on the EVTX file containing the relevant events. It is also detection-oriented, so benign but unusual administration scripts may be surfaced and still need analyst judgment.
Is it beginner-friendly?
Yes, if you know basic Windows logging concepts and can supply a log file or a precise scenario. It is less suitable if you do not know where the PowerShell Operational log came from or cannot confirm that Event 4104 was collected.
How to Improve analyzing-powershell-script-block-logging skill
Provide context that changes the analysis
The biggest quality gain comes from adding host role, user context, and the exact time range. “Domain controller, admin account, 14:20–14:40 UTC, post-phishing triage” is far more useful than a raw EVTX path alone.
Ask for both findings and reconstruction
For better analyzing-powershell-script-block-logging usage, explicitly request reconstructed scripts, suspicious indicators, and a short rationale for each hit. That forces the output to connect fragments back into a complete PowerShell story instead of listing isolated flags.
Watch for common failure modes
The most common misses are truncated script blocks, split payloads not reassembled in order, and overconfident labeling of benign automation as malicious. If the first result looks thin, ask the skill to re-check MessageNumber ordering, compare repeated ScriptBlockId values, and separate “suspicious” from “confirmed.”
Iterate with targeted follow-up prompts
A strong second-pass prompt is: “Re-rank the 4104 events by likelihood of malicious use, explain which detections were driven by -EncodedCommand, FromBase64String, or downloader behavior, and note any benign admin scripts that look similar.” That style of iteration makes the analyzing-powershell-script-block-logging skill more useful for Security Audit decisions and faster analyst review.