Every published rule

PowerShell VBScript RegWrite Registry Modification Attempts

Identifies PowerShell commands embedding VBScript Wscript.shell .RegWrite to modify Windows registry values.

Windows Process Creation: CrushFTP spawning PowerShell, CMD, and scripting tool execution

Detects CrushFTP launching PowerShell/CMD and related LOLBins with command patterns consistent with RCE exploitation behavior.

Windows Suspicious File Writes to SharePoint Web Server Extensions Layouts Directory

Alerts on cmd/powershell/w3wp writes of script or web asset files into SharePoint layouts (15/16 TEMPLATE/ LAYOUTS).

Windows PowerShell sets Microsoft Defender threat severity default actions to Allow/NoAction

Alerts when PowerShell Set-MpPreference sets Defender threat-severity default actions to Allow or NoAction.

Windows Process Execution: Remove Windows Defender Context Menu Registry Keys via reg.exe/PowerShell

Alerts on reg.exe/PowerShell deleting Defender context menu handler registry keys to remove right-click scanning.

Windows Process Information Discovery via Registry Queries (reg.exe/powershell)

Flags reg.exe and PowerShell registry queries used to enumerate OS, Defender, installed apps, timezone, and services.

Windows PowerShell Obfuscated COM MSI Installation via WindowsInstaller.Installer

PowerShell spawning that uses WindowsInstaller.Installer COM with obfuscated strings to call InstallProduct and suppress UI.

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Alerts on PowerShell runs of New-ADServiceAccount to create a delegated service account with -CreateDelegatedServiceAccount and -path.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows Process Creation: Suspicious cmd.exe Launch with Encoded PowerShell from Cleo Suite

Alerts on cmd.exe launching PowerShell encoded commands from Cleo javaw.exe components with .Download.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes

Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.

Windows DISM Enables PowerShell Web Access Feature via Command Line

Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.