Every published rule

Windows Process: curl Download with HTTP Output Redirect and Command Chaining

Flags Windows commands where curl downloads over HTTP with -o and then executes via command chaining with '&'.

Windows: Koadic Command Prompt Invocation with /q /c chcp

Flags cmd.exe executions with /q /c and chcp in the command line, matching Koadic-style command parameters.

Windows Process Access to svchost.exe with High-Rights GrantedAccess

Alerts on high-privilege access to svchost.exe when process call context is UNKNOWN, excluding MSBuild-origin traffic.

Windows Registry Access to WCESERVICE Start Key

Detects registry activity targeting the WCE service Start configuration in Windows.

Windows Process Execution of Windows Credential Editor (WCE) Executables

Flags execution of Windows Credential Editor (WCE.exe/WCE64.exe) using image name endings and known imphash values.

Windows Process Creation: svchost.exe Spawned Without Command-Line Arguments

Flags svchost.exe process starts lacking command-line values, excluding rpcnet/rpcnetp parent cases.

Windows CreateMiniDump.exe HackTool Execution via Process Creation

Detects the execution of CreateMiniDump.exe using image name and a specific IMPHASH.

Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options

Alerts on SharpHound/Bloodhound-like processes launching with discovery-focused command-line parameters.

Windows Process Creation: IIS appcmd Native Module Installation via Command Line

Alerts on appcmd.exe commands installing IIS native-code modules using a -name: parameter, excluding iissetup-launched setups.

Successful Windows Account Logon via WMI (4624 with WmiPrvSE.exe)

Flags successful 4624 logons tied to WmiPrvSE.exe, indicating WMI-driven authentication on Windows.

Windows Security: Detect Domain Trust Creation (Event ID 4706)

Alerts on Windows Event ID 4706 indicating a new trust was created to a domain.

Windows Security: Failed Code Integrity Checks (Event 5038/6281)

Alerts on Windows Security code integrity failures (Event 5038/6281) that may indicate modified or corrupted binaries.

Windows Security Event 6416 for USB Mass Storage Device Plug-In or DiskDrive Recognition

Flags Windows Event ID 6416 entries where a DiskDrive/USB Mass Storage Device is detected as connected.

Windows ProcDump Execution via Renamed Binary

Flags renamed ProcDump usage on Windows by matching procdump indicators and dump flags while excluding known executable names.

Windows Security: Anonymous Logon (4624 LogonType 3) with Loopback IPs

Alerts on Windows 4624 LogonType 3 with ANONYMOUS LOGON and loopback IPs, matching RottenPotato-like patterns.

Windows msiexec.exe Execution from Uncommon Directory

Alerts when msiexec.exe starts from a non-standard path, which may indicate masquerading.

Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process

Alerts when a non-PowerShell executable loads System.Management.Automation.dll on Windows, indicating possible PowerShell execution in another process.

Windows Process Creation: Detect Obfuscated PowerShell IEX Invocation from Invoke-Obfuscation

Detects PowerShell commands showing obfuscation markers consistent with Invoke-Obfuscation-powered IEX invocation.

PowerShell: Obfuscated IEX Invocation via Invoke-Obfuscation String/Variable Patterns

Alerts on obfuscated PowerShell IEX invocation strings built from Invoke-Obfuscation style concatenation patterns in ScriptBlockText.

PowerShell Module Obfuscated IEX Invocation via Invoke-Obfuscation Payload Patterns

Alerts when PowerShell module payloads contain patterns consistent with obfuscated IEX generation via Invoke-Obfuscation.