{"slug":"analyzing-powershell-script-block-logging","source_name":"analyzing-powershell-script-block-logging","name":"Analyzing Powershell Script Block Logging","description":"Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques. Uses python-evtx to extract and reconstruct multi-block scripts, applies entropy analysis and pattern matching for Base64-encoded commands, Invoke-Expression abuse, download cradles, and AMSI bypass attempts.","version":1,"lift":{"pass_rate_delta_pts":22.73,"pass_rate_pct":27.3,"total_cases":22,"passed_cases":6,"tokens_delta_pct":-7.4,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T00:01:09.656714+00:00"},"skill_score":0.2727,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":22.73,"with_pass_pct":27.3,"without_pass_pct":4.5,"tokens_delta_pct":-7.4,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T00:01:09.656714+00:00","run_id":"92a13b77-f25f-450d-8ecd-69522974423d","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"b98a1d027a81451f0205dcc3b4c7a04d50921a814e690476404e2eb2df7611f3","raw_url":"https://app.decimal.ai/s/analyzing-powershell-script-block-logging/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/analyzing-powershell-script-block-logging"}