What log source does it analyze?

It analyzes Windows PowerShell Script Block Logging entries (Event ID 4104) from the PowerShell Operational EVTX file.

How does it handle scripts split across multiple events?

Events sharing a ScriptBlockId are concatenated in MessageNumber order to recover the full script.

Analyzing PowerShell Script Block Logging

SkillMonitoring & ops

Analyzing-powershell-script-block-logging is a skill that guides an AI agent through parsing Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files. It reconstructs scripts split across multiple log blocks and applies heuristics to flag encoded commands, download cradles, AMSI bypasses, and obfuscation, producing a report with risk scores and MITRE ATT&CK mappings.

Use Analyzing PowerShell Script Block Logging in Claude, ChatGPT or Ahel Desktop

Free. Sign in, add Analyzing PowerShell Script Block Logging and connect your AI. About a minute.

Claude ChatGPT Ahel Desktop

Also: Claude Code · Cursor · Codex

Then ask your AI: use the Analyzing PowerShell Script Block Logging skill

Details

Instructions available. Your AI can read the instructions. Execution depends on the setup they require.

Account requirements not reviewed. Check the skill instructions before use; ahel provides instructions and does not run this skill.

No other account needed.

Have Python 3.8 or newer available and install the dependencies with pip install python-evtx lxml.

Analyzing PowerShell Script Block LoggingStart free

What your AI can do with it

Parse Event ID 4104 entries from PowerShell Operational EVTX files using python-evtx
Reconstruct multi-block scripts by concatenating blocks ordered by MessageNumber
Detect Base64-encoded commands such as -EncodedCommand and FromBase64String
Flag download cradles using DownloadString, DownloadFile, Invoke-WebRequest
Identify AMSI bypass patterns like AmsiUtils and amsiInitFailed
Generate a report with risk scores and MITRE ATT&CK mappings

Getting started

Have Python 3.8 or newer available and install the dependencies with pip install python-evtx lxml.
Collect the PowerShell Operational log file (Microsoft-Windows-PowerShell%4Operational.evtx) from the system under investigation.
Run the analysis script against the EVTX file, for example: python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json.
Review the generated report containing reconstructed scripts, risk scores, and MITRE ATT&CK mappings.

What this skill tells your AI

The instructions your AI receives, as published by mukul975/anthropic-cybersecurity-skills in skills/analyzing-powershell-script-block-logging/SKILL.md and read by ahel’s review.

When to Use

When investigating security incidents that require analyzing powershell script block logging
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Familiarity with security operations concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Instructions

Install dependencies: pip install python-evtx lxml
Collect PowerShell Operational logs: Microsoft-Windows-PowerShell%4Operational.evtx
Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber/MessageTotal for multi-part script reconstruction.
Apply detection heuristics:
- Base64-encoded commands (-EncodedCommand, FromBase64String)
- Download cradles (DownloadString, DownloadFile, Invoke-WebRequest, Net.WebClient)
- AMSI bypass patterns (AmsiUtils, amsiInitFailed)
- Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)
Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.

python scripts/agent.py --evtx-file /path/to/PowerShell-Operational.evtx --output ps_analysis.json

Examples

Detect Encoded Command Execution

import base64
if "-encodedcommand" in script_text.lower():
    encoded = script_text.split()[-1]
    decoded = base64.b64decode(encoded).decode("utf-16-le")

Reconstruct Multi-Block Script

Scripts split across multiple 4104 events share a ScriptBlockId. Concatenate blocks ordered by MessageNumber to recover the full script.

Signals

GitHub stars: 34k
Forks: 4k
Last commit: Aug 2026

ahel review

K1info
remote-installer-piped-to-shell
K1binfo
installs-packages
K1info
remote-installer-piped-to-shell (in scripts/agent.py)
K1info
remote-installer-piped-to-shell (in references/api-reference.md)

Automated review, not a security audit. Ruleset v1+k2.

Others that do the same job

analyzing-powershell-script-block-logging
Skill · 26zl analyzing-powershell-script-block-logging
Skill · costrict-plugins-repo

Questions

What log source does it analyze?: It analyzes Windows PowerShell Script Block Logging entries (Event ID 4104) from the PowerShell Operational EVTX file.
How does it handle scripts split across multiple events?: Events sharing a ScriptBlockId are concatenated in MessageNumber order to recover the full script.

Advanced

Item type: skill
Key: analyzing-powershell-script-block-logging-mukul975
Source: github.com/mukul975/anthropic-cybersecurity-skills

github.com/mukul975/anthropic-cybersecurity-skills