[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H99Z6AS4RTETWV5X16A5Q":3,"skill-same:01M71H99Z6AS4RTETWV5X16A5Q":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":14,"repositoryHtmlUrl":65,"repositoryHomepageUrl":6,"ownerHtmlUrl":66,"ownerBlogUrl":6,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M71H99Z6AS4RTETWV5X16A5Q","logging-powershell-detect",null,"Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flogging\u002Fpowershell\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"logging powershell detect","logging","detect","powershell","scripts","de","logs","analysis","security-operations","Bash","invoke","cybersecurity","files","expression","cm","parse","T1059.001","entropy","pattern matching","base64","2026-11-10 10:12:30",false,"---\nname: logging-powershell-detect\ndescription: Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.\ndomain: cybersecurity\nsubdomain: security-operations\ntags:\n- analyzing\n- powershell\n- script\n- block\nnist_csf:\n- DE.CM-01\n- RS.MA-01\n- GV.OV-01\n- DE.AE-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1059.001\ncapec: []\n---\n\n# Analyzing PowerShell Script Block Logging\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing powershell script block logging\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\n1. Install dependencies: `pip install python-evtx lxml`\n2. Collect PowerShell Operational logs: `Microsoft-Windows-PowerShell%4Operational.evtx`\n3. Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber\u002FMessageTotal for multi-part script reconstruction.\n4. Apply detection heuristics:\n   - Base64-encoded commands (`-EncodedCommand`, `FromBase64String`)\n   - Download cradles (`DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `Net.WebClient`)\n   - AMSI bypass patterns (`AmsiUtils`, `amsiInitFailed`)\n   - Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)\n5. Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.\n\n```bash\npython scripts\u002Fagent.py --evtx-file \u002Fpath\u002Fto\u002FPowerShell-Operational.evtx --output ps_analysis.json\n```\n\n## Examples\n\n### Detect Encoded Command Execution\n```python\nimport base64\nif \"-encodedcommand\" in script_text.lower():\n    encoded = script_text.split()[-1]\n    decoded = base64.b64decode(encoded).decode(\"utf-16-le\")\n```\n\n### Reconstruct Multi-Block Script\nScripts split across multiple 4104 events share a `ScriptBlockId`. Concatenate blocks ordered by `MessageNumber` to recover the full script.\n","# Analyzing PowerShell Script Block Logging\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing powershell script block logging\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Familiarity with security operations concepts and tools\n- Access to a test or lab environment for safe execution\n- Python 3.8+ with required dependencies installed\n- Appropriate authorization for any testing activities\n\n## Instructions\n\n1. Install dependencies: `pip install python-evtx lxml`\n2. Collect PowerShell Operational logs: `Microsoft-Windows-PowerShell%4Operational.evtx`\n3. Parse Event ID 4104 entries using python-evtx to extract ScriptBlockText, ScriptBlockId, and MessageNumber\u002FMessageTotal for multi-part script reconstruction.\n4. Apply detection heuristics:\n   - Base64-encoded commands (`-EncodedCommand`, `FromBase64String`)\n   - Download cradles (`DownloadString`, `DownloadFile`, `Invoke-WebRequest`, `Net.WebClient`)\n   - AMSI bypass patterns (`AmsiUtils`, `amsiInitFailed`)\n   - Obfuscation indicators (high entropy, tick-mark insertion, string concatenation)\n5. Generate a report with reconstructed scripts, risk scores, and MITRE ATT&CK mappings.\n\n```bash\npython scripts\u002Fagent.py --evtx-file \u002Fpath\u002Fto\u002FPowerShell-Operational.evtx --output ps_analysis.json\n```\n\n## Examples\n\n### Detect Encoded Command Execution\n```python\nimport base64\nif \"-encodedcommand\" in script_text.lower():\n    encoded = script_text.split()[-1]\n    decoded = base64.b64decode(encoded).decode(\"utf-16-le\")\n```\n\n### Reconstruct Multi-Block Script\nScripts split across multiple 4104 events share a `ScriptBlockId`. Concatenate blocks ordered by `MessageNumber` to recover the full script.\n",{"name":5,"tags":44,"capec":48,"model":49,"tools":50,"domain":30,"maxTurns":54,"nist_csf":55,"subdomain":27,"description":7,"mitre_attack":60},[45,22,46,47],"analyzing","script","block",[],"sonnet",[51,28,52,53],"Read","Glob","Grep",20,[56,57,58,59],"DE.CM-01","RS.MA-01","GV.OV-01","DE.AE-02",[61,35],"T1059","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwindows\u002Flogging\u002Fpowershell\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill logging-powershell-detect",{"tool":75,"command":76},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill logging-powershell-detect",{"tool":78,"command":79},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill logging-powershell-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flogging\u002Fpowershell\u002Fdetect\u002FSKILL.md",true,[83],{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"index.json","REFERENCE","参考文档",690,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Flogging\u002Fpowershell\u002Fdetect\u002Findex.json",[90,112,133,154,176,192],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[97,21,98,99,100,24,33,101,102,103,104,105,106,107,108,109,110,30,111],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":113,"name":114,"nameZh":6,"description":115,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":116,"categories":117,"keywords":118,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[119,97,120,99,121,122,123,30,28,26,124,125,126,127,24,128,129,130,131,132],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[140,141,142,143,144,145,30,28,146,26,147,148,24,130,149,150,151,152,153,49],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":158,"categories":159,"keywords":160,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,161,162,163,164,165,166,33,167,30,111,168,169,170,171,172,173,174,175,24],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":182,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[183,184,21,185,163,165,186,33,187,167,30,111,26,188,189,190,191,175,24,101],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[199,21,163,200,186,33,201,202,30,111,203,204,205,206,207,208,24,101,209,210],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]