Every published rule

Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging

Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.

PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)

Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.

PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows

Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.

PowerShell Script Block Collection of Documents via Recursive Get-ChildItem

Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.

Windows PowerShell Script Block Local Email Collection via Outlook COM Automation

Flags PowerShell script block text referencing Outlook COM automation used to collect locally stored email.

PowerShell command line containing powercat invocation on Windows

Alerts when classic PowerShell starts with Powercat-related command-line strings ('powercat ' or 'powercat.ps1').

Windows Private Key File Recon via cmd.exe, PowerShell, or findstr.exe

Flags Windows command-line searches for key/certificate file extensions using cmd.exe, PowerShell, or findstr.

PowerShell Compress-Archive Creates Archive in Temp or System Temp Paths

Flags PowerShell Compress-Archive usage writing archives to %TEMP%, AppData Local Temp, or Windows Temp.

PowerShell: Compress-Archive to TEMP/AppData/Windows Temp for Staging

Flags PowerShell scripts compressing data with Compress-Archive into $env:TEMP or Temp folders.

Windows PowerShell module usage: Compress-Archive to store archives in Temp locations

Alerts on PowerShell Compress-Archive output written to common temp staging directories.

PowerShell Classic Compress-Archive staging in TEMP or Temp directories

Alerts on PowerShell Compress-Archive output targeting common Temp directories for data staging.

Windows Process Execution of SyncAppvPublishingServer.vbs with Inline PowerShell Commands

Flags Windows executions of SyncAppvPublishingServer.vbs with a semicolon-augmented command line consistent with embedded PowerShell.

PowerShell executes ADRecon.ps1 AD reconnaissance functions and writes ADRecon-Report.xlsx

Detects PowerShell ADRecon reconnaissance script content by matching AD discovery functions and the default ADRecon report output name.

Suspicious PowerShell Execution From Windows Temporary Folders on Windows

Alerts when PowerShell runs with command-line paths pointing to Windows temp directories, excluding some common benign installers.

Windows PowerShell: AtomicTestHarness Invoke-ATHRemoteFXvGPUDisablementCommand Abuse

Alerts on Windows process command lines invoking AtomicTestHarnesses RemoteFXvGPUDisablement PowerShell execution.

Windows PowerShell Module Creation With RemoteFXvGPUDisablement ModuleContents

Flags PowerShell module creation where ModuleContents includes Get-VMRemoteFXPhysicalVideoAdapter.

Windows PowerShell ModuleContents Set to Get-VMRemoteFXPhysicalVideoAdapter

Alerts on PowerShell module creation embedding Get-VMRemoteFXPhysicalVideoAdapter, a potential precursor to RemoteFXvGPUDisablement.exe abuse.

Windows Process: SyncAppvPublishingServer.exe Executes PowerShell via PowerShell-encoded command

Alerts when SyncAppvPublishingServer.exe is launched with a command-line pattern indicative of PowerShell code execution.

Windows Registry Service Install Indicators for Cobalt Strike Staging

Identifies suspicious Windows service installation registry writes tied to ADMIN$/.exe and %COMSPEC% start powershell patterns.

PowerShell Tamper: Set-MpPreference disables Windows Defender scanning and protections

Flags PowerShell attempts to alter Windows Defender preferences using Set-MpPreference with Allow-style disable/default-action parameters.