Every published rule

Windows PowerShell: Invoke-Command targeting -ComputerName via script block

Detects PowerShell Invoke-Command targeting remote hosts by matching script block text with -ComputerName.

Windows PowerShell script enabling WinRM via Enable-PSRemoting

Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.

Windows PowerShell Remote Session Creation via New-PSSession

Flags PowerShell usage of New-PSSession with a ComputerName in script block logging, indicating remote session creation.

Suspicious PowerShell Execution with Base64 Encoded Command (Windows)

Alerts on PowerShell launched with Base64-encoded command-line parameters, excluding likely Guest Configuration noise.

Windows PowerShell Starts Process Using Batch (.cmd/.bat) Scripts

Flags PowerShell Start-Process activity that references .bat/.cmd files, indicating batch script execution attempts.

Windows Backup File Deletion Triggered by CLI or Script Hosts

Alerts when cmd.exe, PowerShell, wt.exe, rundll32.exe, or regsvr32.exe delete files with backup-oriented filename extensions.

Windows PowerShell ScriptBlock checks for service registry ACL inspection

Flags PowerShell scripts that use Get-ACL to inspect service Registry keys under HKLM\SYSTEM\CurrentControlSet\Services.

Windows PowerShell script sets COR_PROFILER environment variables for .NET CLR profiling

Alerts on PowerShell script blocks that set CLR profiler environment variables (COR_ENABLE_PROFILING/COR_PROFILER/COR_PROFILER_PATH).

PowerShell ScriptBlock Requests Kerberos Tickets via IdentityModel Token Assembly

Alerts on PowerShell ScriptBlock text that builds Kerberos ticket requests using KerberosRequestorSecurityToken and .GetRequest().

PowerShell Script Blocks Register Malicious XLL via Office COM Automation on Windows

Detects PowerShell Script Block content that uses COM automation to call .RegisterXLL for an Office XLL add-in.

Windows PowerShell Local User Account Manipulation via Script Block Logging

Alerts when PowerShell script blocks invoke local user management cmdlets that can be used to maintain persistence.

PowerShell AD Account Creation Library Usage via AccountManagement Namespace on Windows

Alert on PowerShell Script Block content referencing System.DirectoryServices.AccountManagement, indicating potential AD principal manipulation.

PowerShell Scheduled Task Creation via ScriptBlock Logging

Identifies PowerShell script blocks that create and register scheduled tasks using TaskScheduler cmdlets or CIM WMI method calls.

Windows PowerShell Screen Capture via CopyFromScreen

Flags PowerShell scripts containing .CopyFromScreen, indicative of desktop screen capture activity.

Windows Suspicious File Downloads from Outlook/OneNote Attachment Domains via Command-Line

Flags Windows command-line downloads using curl/wget or PowerShell from Outlook/OneNote attachment domains.

Windows PowerShell Credential Guessing via LDAP using System.Net.NetworkCredential

Detects PowerShell scripts referencing LDAP connection and .NET network credential handling, potentially indicating remote credential access activity.

Windows PowerShell Copies a DLL into System32 or SysWOW64

Flags PowerShell Copy-Item targeting Windows\System32 or Windows\SysWOW64 for file placement.

Windows PowerShell Wallpaper Replacement via Registry and SystemParametersInfo

Identifies PowerShell script blocks that modify the HKCU Desktop\WallPaper setting to replace a user’s wallpaper.

Windows PowerShell Script: Remove Account From Domain Admin Group via Remove-ADGroupMember

Alerts on PowerShell commands removing specified members via Remove-ADGroupMember, potentially disrupting Domain Admin access.

Java keytool Spawns System Shells or Scripting Utilities on Windows

Alerts when Java keytool.exe spawns command and script execution binaries like cmd.exe or PowerShell on Windows.