Every published rule

PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.

Windows PowerShell: Query SMB Shares via Get-SmbShare

Alerts on PowerShell script blocks running Get-SmbShare to discover SMB shares.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

PowerShell Module: Get-SmbShare Used for SMB Share Discovery

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

Windows process execution of where.exe with browser bookmark database or history artifacts

Alerts on where.exe executions referencing browser history/bookmarks/cookie database artifacts in the command line.

Windows: Delete Backup or System State Backups via wbadmin.exe

Flags wbadmin.exe command lines that delete backup or system state backups, potentially impacting recovery.

Windows wbadmin.exe Deletes All Backup Copies (keepVersions:0)

Flags wbadmin.exe executions that delete all backups/system state backups using keepVersions:0.

Windows PUA: Suspicious Active Directory enumeration using AdFind.exe flags

Flags AdFind.exe processes that look like Active Directory discovery via password policy and object enumeration options.

Windows CMD dir /S File and Subfolder Enumeration

Flags cmd.exe executions using dir with the /S flag to enumerate files in a directory and all subdirectories.

PowerShell Script Block Collection of Browser Bookmarks via Get-ChildItem

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

Windows Process Discovery via wmic.exe "group" Flag

Flags wmic.exe process executions querying local group information via a "group" command-line argument.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.

Windows Process Creation: Nmap/Zenmap (nmap.exe or zennmap.exe) Execution

Flags Windows execution of Nmap/Zenmap (nmap.exe or zennmap.exe) used for remote service discovery.

Windows Net.exe Network Connections Discovery via Use Sessions Query

Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.

Windows Process Creation: SharpView.exe with Recon/Domain Discovery Cmdlets

Alerts when SharpView.exe runs with command-line indicators of AD and network discovery/enumeration activity.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.

Windows Process Creation: Suspicious Executable Image Extension

Flags Windows process creations where the executable image path ends with an unexpected extension, after filtering known benign cases.