Every published rule

Detect Obfuscated PowerShell Command Invocation via Stdin on Windows

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

Windows Process Creation: AtBroker.exe Launching Assistive Technology Apps

Alerts on Windows process starts of AtBroker.exe with "start" that don’t match known built-in accessibility parameters.

PowerShell Obfuscation Delivered via Stdin Using Set-and-Invoke Pattern

Detects obfuscated PowerShell script blocks that use chained stdin/environment/input patterns.

PowerShell Module: Obfuscated Script Execution via Stdin Pattern

Detects obfuscated PowerShell module payloads using chained set and stdin/input invoke patterns.

Windows WMIPRVSE DLL Hijack via Network-Created wbemcomn.dll in System32\wbem

Flags wmiprvse.exe loading wbemcomn.dll from the System32\wbem directory, consistent with a WMI DLL hijack.

Windows DCOM InternetExplorer.Application DLL Hijack via iertutil.dll Image Load

Alerts when iexplore.exe loads iertutil.dll from an Internet Explorer path, indicating possible DLL hijacking.

Windows WMI DLL Hijack via Network-placed wbemcomn.dll in System32\wbem

Alerts when System creates wbemcomn.dll in C:\Windows\System32\wbem\, consistent with WMI DLL hijack file staging.

Windows DCOM InternetExplorer.Application iertutil.dll DLL Hijack Suspicion

Alerts when System writes iertutil.dll in the DCOM InternetExplorer.Application path, consistent with potential DLL hijacking.

Windows System: Service Control Manager runs command with obfuscated PowerShell keywords via set and stdin

Alerts on service creation where ImagePath includes obfuscation-like command chaining with environment/invoke/input strings.

Windows Security Log: Network Write of wbemcomn.dll in System32\wbem for WMI DLL Hijack (T1047)

Flags remote creation of wbemcomn.dll in System32\wbem associated with WMI DLL hijack activity.

Windows Security Event 4697: Obfuscated PowerShell Invocation Through Stdin

Alerts on Service creation events where the service command line includes stdin-style PowerShell obfuscation indicators.

Windows Security: Remote DCOM IE DLL Hijack via iertutil.dll in Internet Explorer path

Flags network file writes of iertutil.dll under IE’s Program Files path associated with potential DCOM DLL hijacking.

Windows Registry Screensaver Path Value Modified (SCRNSAVE.EXE)

Alerts on registry changes to the SCRNSAVE.EXE screensaver binary path under HKCU.

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)

Alerts when PowerShell is launched with a command line containing ConvertTo-SecureString, a credential-related cmdlet uncommon in normal execution.

Windows msbuild.exe Network Connections to Ports 80/443

Alerts on initiated outbound 80/443 connections from msbuild.exe on Windows.

PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

PowerShell Root Certificate Added via LocalMachine\Root Path

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.