Every published rule

SharpImpersonation Tool Execution on Windows

Flags execution of SharpImpersonation.exe on Windows when command-line parameters indicate token impersonation activity.

Windows: Execution of Htran/NATBypass HackTool Binaries or Tran/Slave CLI Flags

Detects Windows executions of htran.exe or lcx.exe and command lines containing -tran or -slave flags.

Windows PowerShell Inline Execution via File Reads and Raw Parameters

Alerts on PowerShell command lines that inline-execute content read from files using -raw.

Windows Process Creation: PowerShell COM CLSID Download Cradles

Alerts on PowerShell command lines using GetTypeFromCLSID with selected CLSIDs that may be used to download files via COM.

PowerShell ScriptBlock COM CLSID GetTypeFromCLSID Download Cradle Indicators

Alerts on PowerShell script blocks using GetTypeFromCLSID with specific CLSIDs indicative of COM-based download cradles.

Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Detects AgentExecutor.exe command lines that trigger PowerShell script execution, including remediations and potentially bypassed ExecutionPolicy.

Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation

Alerts on AgentExecutor.exe launches that pass -powershell/-remediationScript to run PowerShell (including bypass execution policy).

Windows Process Copy/Move of Browser Credential Stores

Identifies Windows commands copying or moving browser user data directories consistent with credential theft.

Windows Process Creation: Suspicious X509Enrollment.CBinaryConverter Execution

Alerts on Windows command lines referencing X509Enrollment.CBinaryConverter with a specific GUID.

PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows

Windows process command lines using PowerShell FromBase64String with MemoryStream and Gzip-like Base64 markers (H4sI) are flagged.

Windows PowerShell Execution of AADInternals Cmdlets (process creation)

Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.

Windows Chromium-Based Browsers Launched with Headless Debugging and User Profile Directory

Alerts on Windows launches of Chromium-based browsers in headless + remote debugging mode targeting a user data directory.

Suspicious X509Enrollment usage in Windows PowerShell scripts

Alerts on PowerShell script blocks containing X509Enrollment.CBinaryConverter and a specific enrollment GUID.

PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream

Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.

Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution

Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.

Windows System Service Installation of Remote Access Tool Services (Event 7045/7036)

Flags Windows service installation or updates for remote access tool services using Service Control Manager events.

Windows Security Event 4697 Service Install of Remote Access Tools

Alerts on Windows service creation (EID 4697) where the service name matches known remote access tool indicators.

Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.

Windows Process Creation: Impersonate.exe HackTool Execution

Flags execution of impersonate.exe (Impersonate tool) on Windows using command-line subcommands or known hashes.