Every published rule

Windows Process Dumping via sqldumper.exe with 0x0110 Command-Line Flags

Alerts on sqldumper.exe executions with command-line dump parameters indicative of process dumping.

Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe

Flags Windows process executions that invoke Pester-related help/commands via PowerShell or cmd, consistent with Pester.bat usage.

Windows Process Execution: Obfuscated PowerShell Invocation Using mshta with VBScript CreateObject

Flags Windows process command lines containing an obfuscated PowerShell+MSHTA VBScript execution pattern.

PowerShell share removal via Remove-SmbShare or Remove-FileShare on Windows

Flags PowerShell commands that remove SMB or file shares through Remove-SmbShare/Remove-FileShare.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

UAC Bypass Using wsreset.exe Registry Command Path (Windows)

Identifies registry TargetObject values associated with a wsreset-style UAC bypass execution command path on Windows.

Xwizard.EXE COM Execution with RunWizard and GUID Argument (Windows)

Alerts when Xwizard.EXE runs with RunWizard plus a GUID-like argument on Windows, consistent with COM execution usage.

Windows: Remote code execution via winrm.vbs using cscript and wmicimv2/Win32_ Create

Alerts on cscript.exe executions referencing winrm and wmicimv2/Win32_ Create with -r:http, consistent with remote code execution via winrm.vbs.

Rundll32 Executes Setupapi.dll InstallHinfSection via Runonce.exe

Alerts when rundll32 passes setupapi.dll::InstallHinfSection arguments that result in launching runonce.exe.

Windows DLL execution via register-cimprovider.exe with -path dll

Alerts on register-cimprovider.exe launching with -path pointing to a DLL.

Windows regedit.exe Imports Registry Keys From .reg File

Detects regedit.exe command lines importing registry keys from .reg files on Windows.

Windows Registry Key Export via regedit.exe (-E) to File

Flags regedit.exe registry exports to files using the -E option, indicating potential discovery or exfiltration prep.

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.

Windows: Process CallTrace using EditionUpgradeManager COM interface DLL

Alerts on process access events with call traces referencing editionupgrademanagerobj.dll via the EditionUpgradeManager COM interface.

Windows regedit.exe exports a registry key into an alternate data stream

Flags regedit.exe executions where the process image ends with '\regedit.exe', consistent with exporting Registry data to an alternate data stream.

PowerShell Service Persistence via Registry ImagePath on Windows

Flags Windows registry service ImagePath entries that reference PowerShell (powershell/pwsh).

Windows: Winrm.vbs AWL bypass using attacker WsmPty.xsl/WsmTxt.xsl

Detects WinRM vbs execution with suspicious XSL formatting arguments, especially when the binary is outside System32/SysWOW64.

Windows: VBoxDrvInst.exe Invoked with driver/executeinf Parameters

Flags VBoxDrvInst.exe launched with parameters indicative of INF processing (driver/executeinf).

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.