Every published rule

Windows process creation: flag suspicious program names and PowerShell script indicators

Alerts on suspicious Windows process image names and PowerShell command-line script/tool patterns commonly used in malicious tooling.

Windows Process Creation: cmd.exe Launching with PowerShell in .lnk Link Command

Alerts when explorer launches cmd.exe with command lines containing both PowerShell and a .lnk reference.

Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Alerts on PowerShell execution of Get-ADReplAccount with -All and -Server parameters for AD replication account enumeration.

Windows PowerShell: Suspicious Unblock-File to Remove Zone.Identifier

Flags PowerShell use of Unblock-File (-Path) that can remove Zone.Identifier downloaded-file metadata.

PowerShell Mount-DiskImage with -ImagePath to Access Disk Images

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

Windows PowerShell: Suspicious Invoke-Item After Mount-DiskImage

Flags PowerShell that mounts an image, derives a drive letter, then runs content via invoke-item from that mount.

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Flags PowerShell Copy-Item operations targeting browser Login Data credential database paths on Windows.

Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Detects PowerShell scripts using Test-NetConnection to reach a target on non-443/80 ports.

Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block

Flags PowerShell scripts referencing SslStream and client-side certificate validation during SSL client authentication.

Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText

Detects PowerShell scripts that make web requests and set a custom -UserAgent value.

Windows PowerShell XML Document Load Used for Execution

Flags PowerShell script blocks that use XML document loading combined with expression/command execution keywords.

PowerShell MsXml2.XmlHttp COM Object Instantiation

Alerts on PowerShell creating an MsXml2.XmlHttp COM object through New-Object -ComObject.

PowerShell ScriptBlock Logging: Set-MpPreference disables Windows Defender scanning or allows threats

Alert on PowerShell Set-MpPreference usage that disables Defender scanning/monitoring or sets threat default actions to Allow.

Windows PowerShell: Start-Process with -PassThru and -FilePath

Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.

Windows PowerShell ScriptBlock Use of Remove-Item to Delete Files or Folders

Alerts on PowerShell ScriptBlockText containing Remove-Item/del/rm/rd-style -Path deletion commands.

Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell

Alert on ws_TomcatService.exe spawning cmd.exe or PowerShell on Windows as suspicious exploitation activity.

PowerShell Script Creates Volume Shadow Copy via Win32_ShadowCopy

Alerts when PowerShell script blocks invoke Win32_ShadowCopy.Create to create a ClientAccessible shadow copy.

Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch

Flags PowerShell-launched chrome.exe that uses --load-extension from local AppData Chrome paths for ChromeLoader-style execution.

PowerShell script exfiltration using Invoke-WebRequest with POST or PUT

PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.

PowerShell DNSExfiltrator command usage (DNSExfiltration)

Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.