Every published rule

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows: Outbound RDP (3389) Connections Initiated by Non-Standard Processes

Alerts on outbound port 3389 connections on Windows when initiated by an unapproved process, suggesting non-standard RDP tooling.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Windows Local User Creation (Security Event 4720)

Flags Windows Security Event ID 4720 indicating a local user account was created.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

Windows: Suspicious Service Installation via Registry ImagePath Outside system32

Alerts on NalDrv/PROCEXP152 service ImagePath registry entries configured outside the expected system32 driver path.

Windows Suspicious PROCEXP152.sys Creation in Local Temp Folder

Flags creation of PROCEXP152.sys in AppData\Local\Temp, excluding events from common Sysinternals executables.

Windows Security Event 4673: SeLoadDriverPrivilege Use by Non-Whitelisted Processes

Flags Windows Event 4673 instances where SeLoadDriverPrivilege is exercised, suggesting attempts to load or unload kernel-mode drivers.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows Security 5145 Network Share Access to Sensitive File Extensions

Alerts when Windows users access network-shared files with extensions commonly targeted for credential or data collection.

Windows GPO Scheduled Task Persistence via SYSVOL ScheduledTasks.xml Writes (Security 5136/5145)

Alerts on GPO changes writing ScheduledTasks.xml to SYSVOL, indicating scheduled-task persistence at scale.

Windows Security 4661 Detects Privileged AD User/Group SID Enumeration via SAM

Identifies SAM_USER/SAM_GROUP access events (4661) aimed at privileged SIDs or names containing 'admin' while ignoring computer accounts.

Windows Security 5136: Modify AD ACL for DCSync Extended Right via ntSecurityDescriptor

Flags directory ACL changes (EventID 5136) that include DCSync extended right GUIDs in ntSecurityDescriptor for DNS objects.

Windows Suspicious EXE in User Directory Launched by Microsoft Office Applications

Alert on Office spawning a .exe from C:\users\ (except when the child is Teams.exe).

Windows Security Logon Event ID 4800: Workstation Lock After Inactivity

Locked Workstation

Windows ADSI Schema Cache (.sch) File Creation by Uncommon Process

Alerts on .sch cache file creation in the Windows SchCache directory by uncommon executables.

Windows Security Event 5136: Suspicious LDAP attribute display names used

Alerts on Event 5136 containing specific LDAP display names indicative of LDAP-based data exchange.

Windows ETW Trace Evasion via Clearing/Disabling Logs or Providers

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

Windows: certutil.exe File Encoding to Base64 Using the -encode Flag

Alerts on Windows certutil.exe executions using -encode to base64-encode a file.

Windows Process Creation: Alert on Suspicious Parent of Core System Executables

Flags when core Windows executables (e.g., svchost, lsass, winlogon) are spawned by suspicious parent processes.