Sigma detection rules, expert-reviewed

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

Windows PowerShell Directory Enumeration via Get-ChildItem and Output Redirection

Flags PowerShell directory enumeration patterns using Get-ChildItem, error suppression, and appended output to a file.

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

PowerShell Get-ADUser Enumeration Using UserAccountControl DONT_REQ_PREAUTH Flag

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

Windows Remote Thread Creation Targeting Uncommon System Image Processes

Alert on Windows remote thread creation events targeting a predefined list of uncommon processes by image path.

Windows schtasks.exe Create Executes File from AppData\Local

Alerts on schtasks.exe creating tasks that run payloads from C:\Users\<user>\AppData\Local.

Windows Process Creation: Suspicious for/foreach Scan Loop with nslookup or ping

Alerts on Windows command lines using for/foreach loops that also run nslookup or ping, consistent with host scanning.

Windows HackTool Process Patterns for CrackMapExec LSASS Dumping

Alerts on Windows command-line process patterns consistent with LSASS dumping in CrackMapExec workflows.

Windows Process Creation: Detect NTDS.DIT and Registry Hive Exfiltration Tooling

Detects suspicious Windows processes that reference NTDS.DIT/SYSTEM hive dumping or staging via common NTDS tooling and scripts.

Windows NTDS Exfiltration File Creation by NTDS Export Filename Patterns

Alerts on Windows file creates using common NTDS-DIT dump/exfiltration filename suffixes like \All.cab and .ntds.cleartext.

Windows Process Creation: OfflineScannerShell.exe mpclient.dll DLL Sideloading Risk

Detects OfflineScannerShell.exe launched with an unexpected current directory that could enable mpclient.dll sideloading.

Windows Process Creation: Replace.exe with -a argument

Detects Replace.exe executions that include the -a argument, which may be used for file replacement.

Windows Suspicious UltraVNC Command Line With Auto-Reconnect Flags

Alerts on UltraVNC execution using -autoreconnect with -connect and -id in the Windows command line.