Every published rule

Suspicious Windows Process Creation as SYSTEM User with Likely Credential/Defense Evasion Commands

Flags SYSTEM-context process executions on Windows that include suspicious tool names or command-line patterns such as PowerShell/Mimikatz indicators.

Windows Registry and PowerShell Modification of ms-settings Protocol Handler

Flags reg.exe or PowerShell registry edits that alter the ms-settings protocol handler open command path.

PowerShell Credential Manager enumeration via vaultcmd /listcreds

Flags PowerShell using vaultcmd /listcreds to enumerate Windows/Web credential manager stored entries.

PowerShell Credential Manager Credential Dump via Script Block Text Matching (Windows)

Alerts on PowerShell script blocks that invoke Windows Credential Manager credential retrieval functions.

PowerShell Credential Discovery via Recursive File Search and Select-String

Flags PowerShell script blocks that recursively list files and run select-string pattern searches, indicative of credential hunting.

Windows: java.exe Parent Spawning cmd/powershell/bash Processes

Alerts when java.exe launches cmd, PowerShell, or bash on Windows, a potential sign of command execution.

PowerShell Security Software Discovery Using get-process Piped to where-object (Windows)

Flags PowerShell scripts that enumerate processes and filter results for security software by vendor/product keywords.

Windows PowerShell: Query SMB Shares via Get-SmbShare

Alerts on PowerShell script blocks running Get-SmbShare to discover SMB shares.

PowerShell ScriptBlock Enumeration of AD Group Membership and User Attributes (Windows)

Flags PowerShell script blocks querying AD group membership and user details for discovery of privileged directory information.

PowerShell Module: Get-SmbShare Used for SMB Share Discovery

Detects PowerShell module usage of Get-SmbShare to enumerate SMB shares across networked systems.

PowerShell module enumeration of AD principals via get-ADPrincipalGroupMembership

Flags PowerShell module usage of Get-ADPrincipalGroupMembership and Get-ADUser with -pr -f patterns indicative of AD discovery.

PowerShell Script Block Collection of Browser Bookmarks via Get-ChildItem

Detects PowerShell Get-ChildItem activity used to recursively enumerate browser bookmarks from a target path.

PowerShell Suspicious Discovery of Local Groups via Get-LocalGroup Cmdlets

Flags PowerShell commands that enumerate local groups and group membership, including WMI/CIM queries for Win32 group data.

PowerShell Local Group Discovery via Get-LocalGroup and Get-LocalGroupMember (Windows)

Identifies PowerShell commands enumerating local groups and their members, indicating potential local permission discovery.

PowerShell Get-NetTCPConnection Network Connection Discovery (Windows)

Detects PowerShell use of Get-NetTCPConnection to enumerate TCP network connections for discovery.

Windows PowerShell: Query TCP connections with Get-NetTCPConnection

Detects PowerShell usage of Get-NetTCPConnection to enumerate TCP network connections.

Windows PowerShell Process Creation with DInjector Cradle Flags (/am51 and /password)

Identifies Dinject PowerShell cradle usage by matching command-line flags '/am51' and '/password' in Windows process creation.

Windows: Suspicious PowerShell Interactive History Files Created as SYSTEM

Alerts on creation of PowerShell interactive history/profile files under SYSTEM, signaling privileged PowerShell activity.

Windows: User Added to Local Remote Desktop Users Group via Net or PowerShell

Detects Windows command-line activity that adds a user to the local Remote Desktop Users group using net localgroup or Add-LocalGroupMember.

Windows PowerShell Clears Console History via Clear-History

Flags PowerShell attempts to clear or delete console/PSReadline command history to hinder command forensics.