Stats
Actions
Tags
From cybersec-toolkit
Detects PowerShell Empire framework artifacts in Windows event logs by identifying Base64 launcher patterns, stager IOCs, module signatures, and staging URLs. Useful for threat hunting and incident response.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:analyzing-powershell-empire-artifactsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (`powershell -noP -sta -w 1 -enc`), Base64 encoded payloads containing `Sy...
PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (powershell -noP -sta -w 1 -enc), Base64 encoded payloads containing System.Net.WebClient and FromBase64String, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation), and staging URL patterns.
powershell -noP -sta -w 1 -enc followed by Base64 blobSystem.Net.WebClient, DownloadData, DownloadString, FromBase64String/login/process.php, /admin/get.php and similar default URI patternsJSON report with matched IOCs, decoded Base64 payloads, timeline of suspicious events, MITRE ATT&CK technique mappings, and severity scores.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitDetects PowerShell Empire framework artifacts in Windows event logs by identifying Base64 launcher patterns, stager IOCs, module signatures, and staging URLs. Useful for threat hunting and incident response.
Detects PowerShell Empire artifacts in Windows event logs via Base64 launcher patterns, stager IOCs, module signatures, user agents, and staging URLs in Script Block Logging. For threat hunting and forensics.
Detects PowerShell Empire artifacts in Windows event logs (4103/4104) via Base64 stagers, module signatures like Invoke-Mimikatz, User-Agents, and C2 URLs. Outputs JSON with IOCs, timelines, MITRE mappings for threat hunting.