Every published rule

Windows PowerShell Software Enumeration via Script Block Content

Flags PowerShell registry queries for installed software metadata combined with selection and table formatting.

PowerShell command-line obfuscation indicators from special-character patterns (Windows)

Alerts on PowerShell executions whose command lines contain repeated special-character obfuscation patterns.

Windows Process Creation: Cmd Invokes PowerShell via Obfuscated Environment Variable Expansion

Alerts on cmd.exe command lines that use obfuscated environment-variable SET to execute PowerShell.

Windows Process Execution Using Obfuscated CMD to Pipe STDIN into PowerShell

Detects obfuscated cmd executions that launch PowerShell and reference $input/noexit patterns for STDIN-based execution.

PowerShell: Obfuscated invocation via Environment Variables in Script Block

Alerts on PowerShell script blocks launching cmd /c or /r with obfuscated set-and-{n} variable expansion patterns.

PowerShell Obfuscated stdin launcher using cmd /c or cmd /r patterns

Detects PowerShell script blocks that use obfuscated STDIN-driven cmd/powershell execution patterns.

PowerShell Module: Obfuscated Environment Variable Expansion via cmd /c set -f Pattern

Alerts when PowerShell module payloads obfuscate execution via cmd /c|/r and environment-variable-based set patterns.

PowerShell Module: Obfuscated STDIN Execution via cmd /c or cmd /r

Alerts when an obfuscated cmd->PowerShell payload uses stdin-style input and noexit/no-execution patterns.

Windows Service Control Manager: Obfuscated Environment Variable PowerShell via cmd /c set -f

Alerts on Service Control Manager event 7045 where a service ImagePath uses cmd /c|/r with "set" and -f formatting.

Windows System Service Control Manager spawning cmd with PowerShell and stdin input obfuscation

Flags SCM-created services whose ImagePath runs cmd to invoke PowerShell using stdin/input and -NoExit patterns.

Windows Security 4697: cmd.exe Launching Obfuscated PowerShell via Environment Variable Expansion

Alerts on EID 4697 service installation command lines containing obfuscated cmd.exe SET patterns used to execute PowerShell via environment variables.

Windows Security Event 4697 PowerShell Launch via cmd/stdin Obfuscation

Alerts on service creation events that run PowerShell through cmd with stdin-style obfuscation markers.

Windows: Malicious Child Process Execution via vsjitdebugger.exe Just-In-Time Debugger

Flags unusual executables launched by vsjitdebugger.exe on Windows, excluding common Visual Studio helper/debugger children.

Windows Process Execution Proxy Using SyncInvoke in CL_Invocation.ps1

Alerts on Windows command lines containing "SyncInvoke" consistent with CL_Invocation.ps1 execution proxy behavior.

Windows Script and LOLBins Loading .NET CLR DLLs via clr.dll, mscoree.dll, mscorlib.dll

Alerts when common scripting/execution binaries load .NET CLR DLLs like clr.dll and mscoree.dll on Windows.

Windows Registry-Based DLL Hijack via WAB.EXE Using WAB Registry DLLPath

Flags WAB.EXE DLLPath registry writes where the configured DLL path differs from the default.

Windows Process Creation: accesschk.exe Permission Audit Execution

Flags AccessChk (accesschk.exe) permission/audit executions using common query flags in Windows process creation logs.

Windows te.exe Execution of Test Components (TAEF) via Process Creation

Alerts on process activity involving te.exe, which may indicate TAEF-based execution of malicious test components.

Windows msiexec.exe Installer Process Spawning cmd.exe or PowerShell

Flags installer-initiated spawning of cmd.exe or PowerShell from Windows\Installer temporary msi-related processes.

Detect Elevated Windows Installer (msiexec) Running as SYSTEM

Flags msiexec.exe MSI activity from Windows Installer running with SYSTEM integrity, excluding known benign parent contexts.