Sigma detection rules, expert-reviewed

Windows PowerShell ScriptBlock alerts for DSInternals cmdlets

Triggers when PowerShell script blocks include DSInternals cmdlets tied to AD/Azure AD key and password auditing or manipulation.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.

Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows

Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.

Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember

Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.

Suspicious File Downloads via PowerShell.EXE from File Sharing Domains on Windows

Flags PowerShell downloading content from known file-sharing/paste domains using DownloadString/DownloadFile or web request syntax.

Windows PowerShell ScriptBlock keyword match for WinPwn tool usage

Alerts when PowerShell ScriptBlock text contains WinPwn execution or script/file reference keywords.

Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes

Flags registry set of \Shell\Open\Command where PowerShell references System.Security.Cryptography crypto classes.

PowerShell Crypto Namespace Class Invocation for Windows Process Creation

Alerts on PowerShell executions that reference System.Security.Cryptography and common crypto class names.

Windows Elevated Shell Spawn via Process Creation (PowerShell or CMD)

Flags creation of privileged PowerShell or cmd.exe processes tied to an elevated logon context.

Windows Process Creation: Detect Event Log Query via wmic.exe, wevtutil.exe, or PowerShell

Detects command-line attempts to query Windows Event Logs using wevtutil, wmic, or Get-WinEvent/Get-EventLog.

Windows: Detects Suspicious cmd.exe or PowerShell spawned from Confluence (tomcat) Processes

Alerts when Confluence/embedded Tomcat spawns cmd.exe or PowerShell on Windows, indicating possible command execution after exploitation.