Every published rule

Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns

Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

Windows PowerShell: Import-Module From Temp, AppData, or Public Directories

Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.

PowerShell disables or removes ETW Trace via Set-EtwTraceProvider or Remove-EtwTraceProvider

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

Flags PowerShell script blocks invoking TroubleshootingPack with unattended answer-file arguments.

Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering

Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.

Windows: FakeUpdates/SocGholish execution via wscript loading a zip-based update script

Flags wscript launched from Temp update .js within a .zip to spawn cmd.exe or PowerShell on Windows.

Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.

Windows sdiagnhost.exe Spawns Suspicious Child Process (PowerShell/CMD/MSHTA/etc.)

Alert when sdiagnhost.exe launches high-risk child processes like PowerShell or CMD, excluding selected benign-like command patterns.

PowerShell: Signed UtilityFunctions.ps1 Loading Managed DLL via Proxy Execution

Flags PowerShell command lines referencing UtilityFunctions.ps1 with RegSnapin usage consistent with managed DLL proxy execution.

Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

Alerts when PowerShell command lines contain encoded obfuscation patterns referencing Net.Webclient with anomalous casing.

Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.

Windows: Jlaive In-Memory Assembly Execution via Copied Batch Executable

Detects chained cmd/.bat staging that uses xcopy plus PowerShell/pwsh and attrib +h/+s to run a .bat.exe payload associated with Jlaive.

Windows PowerShell Script Proxy Execution via CL_mutexverifiers.ps1

Alerts on PowerShell being launched with CL_mutexverifiers that proxies additional script execution.

PowerShell Assembly Loading via CL_LoadAssembly.ps1 Functions

Alerts on PowerShell command lines that call LoadAssemblyFromPath/LoadAssemblyFromNS in CL_LoadAssembly.ps1 context.

Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

Windows PowerShell Execution of Obfuscated One-Liner for In-Memory Module Download

Alerts on Windows PowerShell one-liners containing an obfuscated in-memory download/execute pattern from an HTTP URL.

Windows Process Creation: Suspicious Child Processes Spawned by regsvr32.exe

Alerts when regsvr32.exe spawns suspicious child processes like PowerShell, mshta, or scripting utilities.