Every published rule

Suspicious Child Process Spawning by PowerShell on Windows

Alerts when PowerShell spawns potentially suspicious child binaries (e.g., certutil, mshta, wmic, rundll32), with exclusions for known benign patterns.

Windows Process Creation: Suspicious PowerShell Child of Tomcat prunsrv.exe (CVE-2022-22954 Attempt)

Alerts when prunsrv.exe spawns PowerShell or cmd.exe running PowerShell, consistent with potential Workspace ONE Access RCE attempts.

PowerShell WMI Win32_Product MSI Installation via Invoke-CimMethod

Flags PowerShell using WMI Win32_Product via Invoke-CimMethod to invoke an MSI install.

Windows: File Creation of Get-Variable.exe in PowerShell WindowsApps Path

Alerts on creation of Get-Variable.exe in Local\Microsoft\WindowsApps, a potential cmdlet-path hijack.

Windows: Emotet .LNK Loader Execution via cmd.exe or PowerShell

Alerts on cmd/powershell-launched commands referencing findstr, a .vbs script, and a .lnk file—indicative of shortcut-triggered loader activity.

Windows Process Execution via 7zFM.exe Indicative of CVE-2022-29072 Exploitation

Alerts when 7zFM.exe spawns cmd.exe or PowerShell with command-line patterns consistent with CVE-2022-29072 exploitation attempts.

Windows Process Creation: msiexec.exe Embedding Spawned by PowerShell/cmd/pwsh

Alerts when cmd/powershell launches msiexec.exe with -Embedding, a proxy execution pattern.

Windows schtasks.exe scheduled task creation from suspicious folders

Alerts on schtasks.exe /create using PowerShell/cmd and suspicious folder paths like ProgramData.

Windows File Creation: PowerShell webAdministration Module Path Used in CVE-2022-24527 LPE

Flags Windows file events creating webAdministration.psm1 under PowerShell modules, consistent with CVE-2022-24527 LPE behavior.

PowerShell Hyper-V Cmdlets Execution via Script Blocks (New-VM, Set-VMFirmware, Start-VM)

Alerts when PowerShell script blocks use Hyper-V VM creation or start cmdlets (New-VM, Set-VMFirmware, Start-VM).

Windows Task Scheduler persistence using svchost-launched PowerShell with hidden/Bypass flags

Alerts on svchost.exe Schedule tasks spawning PowerShell with hidden window and execution policy bypass flags.

Windows PowerShell execution from C:\Users\Public

Flags PowerShell command lines that reference C:\Users\Public, indicating likely script execution from a common public staging area.

Windows PowerShell User Discovery via Current Username APIs

Alerts on PowerShell script blocks that retrieve the current username or user identity using common environment/.NET calls.

Windows Registry Key Changes Disabling PowerShell Logging for Current User

Detects registry changes that disable PowerShell module/script logging and transcription by setting logging keys to DWORD 0.

Windows PowerShell: Suspicious GetTypeFromCLSID and ShellExecute usage

Flags PowerShell script blocks that use GetTypeFromCLSID followed by ShellExecute.

Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines

Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.

Windows PowerShell Download and Execution Cradles

Flags PowerShell commands that download remote content and immediately execute it using IEX/Invoke-Expression.

Windows LSA PPL Protection Setting Modification via reg.exe or PowerShell Command Line

Flags Windows command lines that alter LSA PPL-related Control\Lsa registry settings using reg.exe/PowerShell property changes.

Windows Scheduled Task Backdoor Execution via cmd.exe or PowerShell (System EventID /create /delete)

Flags cmd.exe/powershell.exe command lines that create a System/EventID-based scheduled task to run a payload.

Windows Service Installation with PowerShell Download and Hidden Execution

Alerts on Windows service creation (7045) with ImagePath patterns indicating hidden/staged command execution.