home/categories/debugging/mukul975-anthropic-cybersecurity-skills-skills-analyzing-powershell-empire-artifacts-skill-md
debuggingtools
analyzing-powershell-empire-artifacts
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
maintainer
mukul975
Updated 4/6/2026
Stars
4240
Forks
464
quick start
Installation and usage
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
Installation
$ install --globalskills.sh
Usage
Once installed, you can use this skill by running the following command in your terminal:
skills use analyzing-powershell-empire-artifacts