Every published rule

Windows File Events: NTDS.DIT Created by Suspicious or Rare Process

Alerts on creation of ntds.dit on Windows when the creator process image/path is uncommon or located in suspicious directories.

Windows WScript/CScript File Write With Script Extensions to Temp or Startup Paths

Alerts when WScript/CScript writes script files (.js/.vbs/.wsf/.wsh, etc.) into common temp or Startup directories.

Windows Registry: Disable Microsoft Defender Firewall by Setting EnableFirewall to 0

Flags Windows Registry changes that disable Defender firewall by setting EnableFirewall DWORD to 0.

Windows netsh Enables Defender Firewall Group Rules via advfirewall set rule group new enable=Yes

Flags netsh.exe command lines that create and enable Microsoft Defender Firewall group rules (enable=Yes).

Windows: AppCmd disables IIS HTTP logging via dontLog=true

Flags appcmd.exe commands that disable IIS HTTP logging by setting httplogging to dontLog:true.

Windows Dynamic C# Compilation Generates .cmdline Artifact

Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.

Windows: Detect mstsc.exe Remote Desktop connection via /v flag

Flags Windows RDP connection attempts started by mstsc.exe using the /v: target argument, excluding WSL helper scenarios.

Windows HackTool Activity: Evil-WinRM Ruby Process with -i, -u, -p Arguments

Flags Ruby processes launched with Evil-WinRM parameters (-i, -u, -p), indicative of WinRM remote access attempts.

PowerShell script exfiltration using Invoke-WebRequest with POST or PUT

PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.

PowerShell DNSExfiltrator command usage (DNSExfiltration)

Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.

Windows PowerShell: Invoke-Command targeting -ComputerName via script block

Detects PowerShell Invoke-Command targeting remote hosts by matching script block text with -ComputerName.

Windows PowerShell script enabling WinRM via Enable-PSRemoting

Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.

Windows Suspicious Outbound SMTP Connections on Common Mail Ports

Alerts on outbound, initiated SMTP connections to ports 25/465/587/2525, excluding specific mail/Exchange processes.

Windows Registry: Detect windir Environment Key Changes for SilentCleanup UAC Bypass

Detects non-default Environment\windir registry changes commonly used to facilitate SilentCleanup UAC bypass.

Windows Process Creation: DumpStack.log Used to Evade Microsoft Defender

Alerts on Windows processes launched with DumpStack.log in the image name and command-line output argument.

Potential DLL Injection via AccCheckConsole.exe Command-Line Parameters on Windows

Alerts on AccCheckConsole.exe executions whose CLI parameters align with loading custom verification logic via a DLL.

Windows PowerShell Remote Session Creation via New-PSSession

Flags PowerShell usage of New-PSSession with a ComputerName in script block logging, indicating remote session creation.

Windows Registry: Disable User Account Control by setting EnableLUA to 0

Alerts on Windows registry changes that disable UAC by writing EnableLUA as 0.

Registry Modification for UAC Bypass via Event Viewer Command Handler (Windows)

Monitors registry value changes to the Event Viewer command handler path indicative of a UAC bypass attempt on Windows.

Windows Registry: Detect DelegateExecute UAC bypass via TargetObject path

Alerts on registry set events targeting \open\command\DelegateExecute with empty Details, consistent with a UAC bypass attempt.