Every published rule

Windows Process Creation: cmd.exe Spawned from Edge Elevation Service (CVE-2021-41379)

Alerts when cmd.exe or PowerShell spawns under Edge elevation service with SYSTEM integrity, consistent with CVE-2021-41379 exploitation.

Windows ZipExec-Style Suspicious PowerShell/Command Execution with Password-Protected ZIP

Flags Windows processes running ZipFolder zip commands with password and .zip filename parameters, optionally including deletion.

Windows Process Creation: PowerShell ExecutionPolicy Set to Bypass/Unrestricted

Alerts on PowerShell started with -ExecutionPolicy set to Bypass/Unrestricted, indicating a potentially insecure script execution posture.

PowerShell Creating Startup .lnk Shortcut Persistence (Windows File Events)

Detects PowerShell writing .lnk files into the Windows Startup folder, a common persistence mechanism.

PowerShell Hidden WindowStyle Indicator in Script Block Text (Windows)

Flags PowerShell script block text indicating WindowStyle set to Hidden, suggesting concealed execution.

PowerShell: Set-ExecutionPolicy to Unrestricted or Bypass

Alerts when PowerShell sets execution policy to Unrestricted or bypass, indicating weakened script execution controls.

Windows PowerShell: Disable Windows Firewall Profile via Set-NetFirewallProfile

Flags PowerShell commands that disable one or more Windows Firewall profiles via Set-NetFirewallProfile -Enabled $false.

Windows vmtoolsd.exe Child Process Spawn via Scripting/Utility Binaries

Alert on vmtoolsd.exe spawning cmd/powershell/mshta/regsvr32/rundll32/wscript child processes with VM Tools batch-script command lines.

PowerShell Live Memory Dump via Get-StorageDiagnosticInfo with -IncludeLiveDump (Windows)

Identifies PowerShell use of Get-StorageDiagnosticInfo with -IncludeLiveDump to trigger a live memory dump on Windows.

PowerShell Add-DnsClientNrptRule Modifies NRPT Namespaces

Flags PowerShell scripts that add DNS Name Resolution Policy Table rules for a specified namespace.

PowerShell ScriptBlock launching redirected comspec to Alternate Data Stream via '>'

Flags PowerShell script blocks using Start-Process with comspec and " > " redirection consistent with ADS-style file hiding.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

PowerShell Write-Hijack HackTool Creates .bat for DLL Hijack Execution (Windows)

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

PowerShell WMI Event Subscription Persistence via New-CimInstance

Finds PowerShell creating WMI __EventFilter and CommandLineEventConsumer objects for event-triggered persistence.

Windows PowerShell: Add-Content to $profile for Potential Persistence

Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.

PowerShell ShellIntel Commandlet Abuse via ScriptBlock Logging

Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.

Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths

Flags Exchange-targeted web requests with /autodiscover.json plus exploit URI fragments returning 200/301.

Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)

Flags Exchange web requests with ProxyShell-like /autodiscover.json query patterns and PowerShell/EWS-related parameters, often returning HTTP 401.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.