From cybersec-toolkit
Parses Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques using python-evtx.
How this skill is triggered — by the user, by Claude, or both
Slash command
/cybersec-toolkit:analyzing-powershell-script-block-loggingThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
- When investigating security incidents that require analyzing powershell script block logging
pip install python-evtx lxmlMicrosoft-Windows-PowerShell%4Operational.evtx-EncodedCommand, FromBase64String)DownloadString, DownloadFile, Invoke-WebRequest, Net.WebClient)AmsiUtils, amsiInitFailed)python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json
import base64
if "-encodedcommand" in script_text.lower():
encoded = script_text.split()[-1]
decoded = base64.b64decode(encoded).decode("utf-16-le")
Scripts split across multiple 4104 events share a ScriptBlockId. Concatenate blocks ordered by MessageNumber to recover the full script.
npx claudepluginhub 26zl/cybersec-toolkit --plugin cybersec-toolkitParses Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques using python-evtx.
Parses Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files using python-evtx to reconstruct scripts and detect obfuscated commands, Base64 payloads, download cradles, Invoke-Expression abuse, and AMSI bypasses for threat hunting.
Parses PowerShell script block logs (Event ID 4104) from EVTX files to detect obfuscated commands, Base64 payloads, download cradles, AMSI bypasses via python-evtx, entropy analysis, and pattern matching.