analyzing-powershell-empire-artifacts
This skill detects PowerShell Empire post-exploitation framework artifacts in Windows event logs by identifying the framework's characteristic launcher strings, Base64 encoded payloads, known module invocations, and staging URL patterns across PowerShell Script Block Logging and Module Logging events. Use it during incident investigations to hunt for Empire activity, build detection rules for SOC teams, or validate security monitoring coverage for post-exploitation techniques.
git clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/analyzing-powershell-empire-artifacts && cp -r /tmp/analyzing-powershell-empire-artifacts/skills/analyzing-powershell-empire-artifacts ~/.claude/skills/analyzing-powershell-empire-artifactsSKILL.md
# Analyzing PowerShell Empire Artifacts ## Overview PowerShell Empire is a post-exploitation framework consisting of listeners, stagers, and agents. Its artifacts leave detectable traces in Windows event logs, particularly PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103). This skill analyzes event logs for Empire's default launcher string (`powershell -noP -sta -w 1 -enc`), Base64 encoded payloads containing `System.Net.WebClient` and `FromBase64String`, known module invocations (Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation), and staging URL patterns. ## When to Use - When investigating security incidents that require analyzing powershell empire artifacts - When building detection rules or threat hunting queries for this domain - When SOC analysts need structured procedures for this analysis type - When validating security monitoring coverage for related attack techniques ## Prerequisites - Python 3.9+ with access to Windows Event Log or exported EVTX files - PowerShell Script Block Logging (Event ID 4104) enabled via Group Policy - Module Logging (Event ID 4103) enabled for comprehensive coverage ## Key Detection Patterns 1. **Default launcher** — `powershell -noP -sta -w 1 -enc` followed by Base64 blob 2. **Stager indicators** — `System.Net.WebClient`, `DownloadData`, `DownloadString`, `FromBase64String` 3. **Module signatures** — Invoke-Mimikatz, Invoke-Kerberoast, Invoke-TokenManipulation, Invoke-PSInject, Invoke-DCOM 4. **User agent strings** — default Empire user agents in HTTP listener configuration 5. **Staging URLs** — `/login/process.php`, `/admin/get.php` and similar default URI patterns ## Output JSON report with matched IOCs, decoded Base64 payloads, timeline of suspicious events, MITRE ATT&CK technique mappings, and severity scores.
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
Take over Active Directory accounts by writing attacker-controlled public keys to msDS-KeyCredentialLink (Shadow Credentials) with pyWhisker, Whisker, or Certipy, then authenticate via PKINIT to recover the target's NT hash without a password reset. Use when BloodHound shows GenericWrite/GenericAll/AddKeyCredentialLink over a target, as a stealthier alternative to ForceChangePassword, during authorized red-team engagements.
>-
Create forensically sound bit-for-bit disk images with dd or dcfldd on a Linux forensic workstation, preserving evidence integrity through hash verification (MD5/SHA) during acquisition. Use when imaging a suspect drive, USB device, or memory card for investigation, preserving volatile disk evidence during incident response, or producing a verified copy for legal or law-enforcement proceedings before any destructive analysis.
Detect dangerous ACL misconfigurations in Active Directory using ldap3
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect