skills.rest
Axxxxxxaaann
AxxxxxxaaannCOMMUNITY
Explore all skills by this author →
GitHub

analyzing-powershell-empire-artifacts

Detect Empire launcher patterns and module signatures in PowerShell event logs.

Updated Aug 27, 2026
Search Tags:#powershell#threat-hunting#empire#script-block-logging#module-logging#base64-decoding#ioc-detection
One-click install
npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-powershell-empire-artifacts
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: analyzing-powershell-empire-artifacts
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-powershell-empire-artifacts
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-powershell-empire-artifacts

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

PowerShell Empire artifacts can hide in Windows event logs, making it difficult for security teams to quickly identify compromised systems. This Skill provides a structured approach to detect Empire launcher patterns, stager IOCs, module signatures, staging URIs, and default user agents in Script Block Logging events, enabling faster containment and response.

Core Features & Use Cases

  • Detects the default Empire launcher pattern in PowerShell Script Block Logging (Event ID 4104) and decodes embedded Base64 payloads for analysis.
  • Identifies Empire stager indicators such as System.Net.WebClient usage, FromBase64String decoding, and common IEX/Invoke-Expression execution patterns.
  • Flags Empire module signatures (e.g., Invoke-Mimikatz, Invoke-Kerberoast) along with default staging URIs and user agents to support threat-hunting workflows.
  • Produces a structured report mapping detections to MITRE ATT&CK techniques and facilitating incident response.

Quick Start

Run the agent script to scan Windows PowerShell event logs for Empire artifacts and generate findings.

Frequently Asked Questions about analyzing-powershell-empire-artifacts

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect PowerShell Empire artifacts in Windows event logs?▼

To detect PowerShell Empire artifacts in Windows event logs, scan Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) for default launcher patterns, stager indicators, and module signatures. This identifies compromised systems for incident response.

What PowerShell log events contain Empire stager indicators?▼

PowerShell Empire stager indicators are primarily found in Script Block Logging events (Event ID 4104). These logs contain patterns like FromBase64String decoding, IEX execution, and System.Net.WebClient usage that reveal malicious staging activity.

How do I decode Base64 payloads hidden in PowerShell Script Block logs?▼

Decoding Base64 payloads hidden in PowerShell Script Block logs requires analyzing Event ID 4104 entries to extract embedded encoded strings. The decoded content reveals the actual malicious commands executed by Empire launchers.

Can I map detected Empire IOCs to MITRE ATT&CK techniques?▼

Mapped Empire IOCs directly correlate with MITRE ATT&CK techniques to provide structured incident response findings. The detection process flags module signatures like Invoke-Kerberoast and outputs them with their corresponding ATT&CK classifications.

Does threat hunting for Empire artifacts require Windows Module Logging enabled?▼

Threat hunting for Empire artifacts relies heavily on having Windows PowerShell Module Logging (Event ID 4103) and Script Block Logging (Event ID 4104) enabled. These event logs provide the necessary telemetry to capture stager indicators and module signatures.

What are common Empire module signatures to look for during incident response?▼

Common Empire module signatures to look for during incident response include Invoke-Mimikatz, Invoke-Kerberoast, default staging URIs, and default user agents. Identifying these signatures in PowerShell logs confirms unauthorized credential access and lateral movement attempts.

Related Skills

Explore More Data & Analytics Skills→
belokonmbelokonm
8

powershell-security-hardening

Configure PowerShell security hardening with constrained language mode, JEA, and logging.

Community
Advanced
UnitOneAIUnitOneAI
44

containment

Generate NIST SP 800-61 Rev 2-aligned containment plans with MITRE ATT&CK-mapped countermeasures.

Official
Intermediate
aviskaaraviskaar
6

threat-hunter

Conduct proactive threat hunting campaigns using MITRE ATT&CK frameworks.

Official
Advanced
archview-aiarchview-ai

openwebf-app-debugging-devtools

Diagnose WebF runtime issues using Chrome DevTools console, network, and DOM inspection.

Official
Intermediate