Every published rule

Windows PowerShell ScriptBlock checks for service registry ACL inspection

Flags PowerShell scripts that use Get-ACL to inspect service Registry keys under HKLM\SYSTEM\CurrentControlSet\Services.

Windows PowerShell script sets COR_PROFILER environment variables for .NET CLR profiling

Alerts on PowerShell script blocks that set CLR profiler environment variables (COR_ENABLE_PROFILING/COR_PROFILER/COR_PROFILER_PATH).

Windows: File creation of C:\program.exe enabling unquoted service path execution

Flags creation of C:\program.exe that can be used to hijack unquoted Windows service binary paths.

Windows: Suspicious .SCR Screensaver File Creation

Alerts on creation of new .scr screensaver binaries on Windows, excluding known benign paths and a specific TiWorker case.

Windows File Creation: Custom Application Shim Database Files Created

Flags creation of custom Application Shim database files in AppPatch custom directories on Windows.

Windows Registry Changes to Outlook Security Settings

Alerts on registry updates to Outlook security configuration keys on Windows, excluding direct Outlook.exe changes.

Windows Registry Startup: Chrome VPN Extensions Installed via Extension Registry Keys

Flags Windows Registry updates that register VPN/proxy Chrome extensions via the Chrome Extensions update_url key.

Windows Process Creation: Suspicious Kernel Dump via dtrace.exe lkd(0) and syscall:::return

Alerts on Windows process executions of dtrace.exe with command lines consistent with kernel dumping (lkd).

PowerShell ScriptBlock Requests Kerberos Tickets via IdentityModel Token Assembly

Alerts on PowerShell ScriptBlock text that builds Kerberos ticket requests using KerberosRequestorSecurityToken and .GetRequest().

PowerShell Script Blocks Register Malicious XLL via Office COM Automation on Windows

Detects PowerShell Script Block content that uses COM automation to call .RegisterXLL for an Office XLL add-in.

Windows PowerShell Local User Account Manipulation via Script Block Logging

Alerts when PowerShell script blocks invoke local user management cmdlets that can be used to maintain persistence.

PowerShell AD Account Creation Library Usage via AccountManagement Namespace on Windows

Alert on PowerShell Script Block content referencing System.DirectoryServices.AccountManagement, indicating potential AD principal manipulation.

PowerShell Scheduled Task Creation via ScriptBlock Logging

Identifies PowerShell script blocks that create and register scheduled tasks using TaskScheduler cmdlets or CIM WMI method calls.

Windows PowerShell Screen Capture via CopyFromScreen

Flags PowerShell scripts containing .CopyFromScreen, indicative of desktop screen capture activity.

Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line

Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.

Windows Process Execution of Hashcat.exe for Password Cracking

Alerts on Hashcat.exe launched with cracking-focused flags targeting an offline SAM-derived dataset.

Windows: Findstr searches GPP cpassword in SYSVOL XML

Alerts when Windows findstr/find searches SYSVOL XML files for GPP cpassword.

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Copies a DLL into System32 or SysWOW64

Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.

Windows schtasks.exe /disable Used to Disable Security-Critical Scheduled Tasks

Flags schtasks.exe executions using /disable against security-critical Windows scheduled task paths.