Every published rule

Windows Process Creation: cmd.exe Launching with PowerShell in .lnk Link Command

Alerts when explorer launches cmd.exe with command lines containing both PowerShell and a .lnk reference.

Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Alerts on PowerShell execution of Get-ADReplAccount with -All and -Server parameters for AD replication account enumeration.

Windows Registry ServiceDll Hijack via Service Parameters\ServiceDll

Alerts on ServiceDll value changes for Windows services in the registry, indicating potential DLL load persistence.

Windows NTLM brute force targeting workstation/device names

Alerts on NTLM EventID 8004 when WorkstationName equals common spoofed client names used in brute force attempts.

Windows PowerShell: Suspicious Unblock-File to Remove Zone.Identifier

Flags PowerShell use of Unblock-File (-Path) that can remove Zone.Identifier downloaded-file metadata.

PowerShell Mount-DiskImage with -ImagePath to Access Disk Images

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

Windows PowerShell: Suspicious Invoke-Item After Mount-DiskImage

Flags PowerShell that mounts an image, derives a drive letter, then runs content via invoke-item from that mount.

Windows Suspicious takeown.exe Recursive Ownership Change

Alerts when takeown.exe is run with recursive and file/folder targeting, indicating potential defense impairment via ownership changes.

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Flags PowerShell Copy-Item operations targeting browser Login Data credential database paths on Windows.

Windows File Writes of TeamViewer Session Logs

Flags Windows file creation events for TeamViewer session log artifacts like vprint.db and TVNetwork.log.

Windows DNS Queries for TeamViewer Domains Triggered by Non-TeamViewer Image

Alerts when TeamViewer domains are resolved via DNS by a process whose image name does not include "TeamViewer".

Windows: Application Uninstall via WMIC.exe (WMIC call uninstall)

Flags WMIC.exe commands that include "call" and "uninstall," indicating potential application removal on Windows.

Windows: whoami.exe Executed by Privileged Accounts

Flags execution of whoami.exe from privileged-like accounts using Windows process creation events.

Windows: Detect XORDump Utility Launch With LSASS Dump and Debug Module Switches

Alerts on xordump.exe spawning with LSASS-targeting and dump-module switches indicative of credential theft.

Windows File Creation of TeamViewer_Desktop.exe During Install

Alerts on Windows when TeamViewer_Desktop.exe is created, indicating potential installation or dropped remote-access binaries.

Windows Installer Application Removed via MsiInstaller Events

Alerts on Windows Installer events indicating an application was removed via MsiInstaller.

Windows Process Hollowing Suspected via Replaced In-Memory Image

Alerts on Windows events where a process image is replaced in memory, suggesting possible process hollowing.

Windows LOLBIN Execution From Abnormal Drive (calc, certutil, mshta, regsvr32, rundll32)

Flags Windows LOLBIN execution when process CurrentDirectory is not empty/null and contains C:\, indicating unusual launch context.

Windows: RunXCmd Command-Line Execution with System or TrustedInstaller Accounts

Flags RunXCmd usage on Windows when invoked to execute commands as System or TrustedInstaller.

Windows Process Execution: NSudo (NSudo.exe/NSudoLC/NSudoLG)

Alerts on NSudo execution on Windows with privilege and integrity/elevation command-line parameters.