Every published rule

Windows bash.exe Launched with -c for Indirect Inline Command Execution

Alerts on Windows processes starting bash.exe with -c, indicating inline command execution.

Windows: aspnet_compiler.exe Execution Detection

Detects execution of aspnet_compiler.exe from Windows .NET Framework directories, which can be abused to compile and run C#.

Windows DNS Queries Triggered by DesktopAppInstaller AppInstaller.EXE

Identifies DNS lookups performed by Windows AppInstaller.EXE when initiating ms-appinstaller package installation from a URL.

Windows PsExec/PAExec Command-Line Flags Escalating to LOCAL SYSTEM

Flags in PsExec/PAExec command lines requesting LOCAL SYSTEM execution are matched via process creation command-line telemetry.

Windows process access to LSASS.exe with suspicious GrantedAccess flags

Alerts on process access attempts to lsass.exe with GrantedAccess rights commonly linked to credential theft behavior.

Windows Shell/Scripting Tool File Write to Suspicious Directories

Alert on file writes by common Windows shells/scripting tools to C:\PerfLogs, C:\Users\Public, or C:\Windows\Temp.

Windows Registry New File Association via exefile Handler (Classes\*.exefile)

Alerts on Windows registry changes creating a new file association that points to the exefile handler.

Windows WinRAR or RAR Utility Execution from Non-Default Installation Paths

Alerts on WinRAR/RAR process execution when launched from folders outside standard WinRAR installation paths.

Windows ADCS Template Enrollment Supplies Subject and Risky EKU (Event ID 4898/4899)

Flags ADCS template load/update events (4898/4899) when risky EKU OIDs and enrollee-supplied subject are present.

Windows AD CS Certificate Template Updated/Created Enrollee Supplies Subject Flag

Alerts when AD CS certificate templates are created or updated with CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT.

Windows Suspicious Scheduled Task File Write Targeting System32 Tasks

Alerts on scheduled task storage writes under System32\Tasks originating from suspicious process locations.

Windows: reg.exe Adds BitLocker Policy Registry Values

Flags reg.exe registry additions targeting BitLocker policy keys associated with configuration changes.

Windows LSASS Memory Dump File Creation

Alerts on Windows file creation of LSASS memory dump artifacts identified by high-confidence filename patterns.

Windows Office Apps Initiate Outbound Network Connections to Non-Private IPs

Alerts when Office app processes initiate outbound TCP/HTTP(S)/mail connections to non-private IPs, excluding common private and known provider ranges.

Suspicious DNS Query Patterns for Cobalt Strike Beacons on Windows (Sysmon)

Alerts on Windows Sysmon DNS queries with QueryName patterns consistent with Cobalt Strike DNS beaconing.

Windows HackTool Activity: Mimikatz Kerberos Ticket and MemSSP File Creation

Alerts on Windows file creation events for Mimikatz-related .kirbi and mimilsa.log files.

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

Windows Process Creation: cscript/wscript Register-App.vbs COM+ Registration

Alert on cscript/wscript running “.vbs -register” to register COM+ components, potentially leveraging register_app.vbs.

Windows: Cmdl32.EXE Arbitrary File Download Indicator via /vpn and /lan Flags

Flags cmdl32.exe executions using /vpn and /lan that may indicate arbitrary file retrieval behavior.

Windows Process Creation: PowerShell ExecutionPolicy Set to Bypass/Unrestricted

Alerts on PowerShell started with -ExecutionPolicy set to Bypass/Unrestricted, indicating a potentially insecure script execution posture.