Every published rule

Windows Process Creation: Command-Line Deletion of IIS Logs

Flags command-line attempts on Windows to delete IIS logs using common deletion utilities and the \inetpub\logs\ path.

Windows: Suspicious Velociraptor Child Process Execution Indicators

Alerts when Velociraptor.exe spawns specific child processes tied to tunneling, msiexec web installs, or PowerShell download commands.

Windows PowerShell Uninstall-WindowsFeature/Remove-WindowsFeature Removing Windows-Defender GUI

Detects PowerShell uninstall/removal commands targeting the Windows-Defender GUI feature.

VBScript Registry Write Attempt via Wscript.shell RegWrite on Windows

Flags command lines containing Wscript.shell CreateObject and RegWrite, indicating VBScript-driven registry modification attempts.

PowerShell VBScript RegWrite Registry Modification Attempts

Identifies PowerShell commands embedding VBScript Wscript.shell .RegWrite to modify Windows registry values.

Windows Reagentc.exe WinRE Disabled via /disable Command-Line Switch

Flags Reagentc.exe executions using /disable to disable Windows Recovery Environment (WinRE).

Windows WMIC Registry Changes via WMI StdRegProv Write Methods

Flags wmic.exe commands invoking WMI StdRegProv to create/delete keys or set registry values.

Windows WMI StdRegProv Registry Enumeration via wmic.exe

Flags wmic.exe usage invoking WMI StdRegProv registry read/enumeration methods for discovery.

Windows WMI (wmic.exe) Sets User Password to Never Expire

Detects wmic.exe commands that set a Windows account password to never expire via WMI.

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

Windows: Suspicious Attachment File Created in Outlook Temp Directories

Alerts on creation of risky file types in Outlook attachment temporary folders used during email attachment handling.

Windows: WinRAR/Rar.exe Writing Files to Startup Folder Locations

Alerts on WinRAR/Rar creating files under the Windows Startup folder, a common persistence attempt.

Windows Scheduled Task Creation via schtasks.exe Using sshd/ssh.exe for Tunnel Setup

Alerts when schtasks.exe creates scheduled tasks that invoke sshd.exe or ssh.exe with tunnel-related arguments.

Windows registry delete: remove ShellEx ContextMenuHandlers EPP key for "Scan with Defender"

Alerts when a registry key tied to the Defender “Scan with” context menu is deleted, excluding MsMpEng.exe activity.

Windows PowerShell sets Microsoft Defender threat severity default actions to Allow/NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

Windows reg.exe disables Defender WMI Autologger sessions by setting Start to 0

Flags reg.exe changing WMI Autologger Start for DefenderApiLogger/DefenderAuditLogger to 0, impairing ETW security logging.

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Detects ADExplorer exporting an AD snapshot by writing .dat files on Windows.

Windows Registry Set: FileFix-style Command Evidence in TypedPaths url1

Flags Windows registry TypedPaths url1 updates containing URL fragments and command/script keywords consistent with FileFix behavior.

Windows Process Creation: HollowReaper.exe Execution for Process Hollowing

Flags execution of HollowReaper.exe, a process hollowing shellcode launcher associated with stealth payload execution.