Every published rule

PowerShell Script Block Obfuscation via cmd/clipboard and clip.exe execution

Identifies obfuscated PowerShell script blocks launching clip.exe and chaining clipboard-related execution.

PowerShell Module: VAR++ LAUNCHER Obfuscation in Obfuscated Command Payload

Identifies obfuscated PowerShell module payloads matching a VAR++ LAUNCHER-style invocation pattern.

PowerShell Module: Obfuscated Clip.exe launcher using cmd with clipboard download payload

Detects obfuscated PowerShell module commands that run cmd with clip.exe/clipboard payload formatting.

Windows System: Detects Service Control Manager spawning obfuscated PowerShell via VAR++ LAUNCHER

Flags newly created Windows services whose ImagePath contains cmd chaining and obfuscated PowerShell launcher indicators.

Windows System Service Control: Obfuscated cmd Launching clip.exe for PowerShell

Flags service creation (Event 7045) with obfuscated cmd ImagePath using clip.exe/clipboard PowerShell execution patterns.

Windows Security 4697 Alert for Obfuscated PowerShell Invoke via VAR++ LAUNCHER

Alerts on obfuscated PowerShell launcher patterns in Windows service creation events (EID 4697) consistent with VAR++ LAUNCHER.

Windows Security Log: Obfuscated cmd Execution of clip.exe via PowerShell Clipboard Patterns (EID 4697)

Alerts on service creation (Windows 4697) with CLIP.exe command-line patterns that indicate obfuscated PowerShell execution.

Windows Process Creation: PowerShell or sc.exe Disabling Windows Defender Behavior Monitoring

Detects PowerShell flags or sc.exe service actions that disable WinDefend monitoring on Windows.

Detect Obfuscated PowerShell Command Invocation via Stdin on Windows

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

PowerShell Obfuscation Delivered via Stdin Using Set-and-Invoke Pattern

Detects obfuscated PowerShell script blocks that use chained stdin/environment/input patterns.

PowerShell Module: Obfuscated Script Execution via Stdin Pattern

Detects obfuscated PowerShell module payloads using chained set and stdin/input invoke patterns.

Windows System: Service Control Manager runs command with obfuscated PowerShell keywords via set and stdin

Alerts on service creation where ImagePath includes obfuscation-like command chaining with environment/invoke/input strings.

Windows Security Event 4697: Obfuscated PowerShell Invocation Through Stdin

Alerts on Service creation events where the service command line includes stdin-style PowerShell obfuscation indicators.

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

Windows Process Creation: Detect Reversed PowerShell Command Tokens in CommandLine

Alerts on suspicious reversed token usage in PowerShell command lines on Windows, excluding -EncodedCommand / -enc.

PowerShell ConvertTo-SecureString Cmdlet Execution from Command Line (Windows)

Alerts when PowerShell is launched with a command line containing ConvertTo-SecureString, a credential-related cmdlet uncommon in normal execution.

PowerShell Execution via sqlps.exe (Windows Process Creation)

Flags sqlps.exe process launches consistent with PowerShell execution on Windows, excluding common sqlagent.exe-driven cases.

PowerShell Root Certificate Added via LocalMachine\Root Path

Flags PowerShell scripts that move and import certificates into the local machine root store (Cert:\LocalMachine\Root).

Windows PowerShell ICMP Exfiltration via Ping and Socket Send

Alerts on PowerShell that instantiates System.Net.NetworkInformation.Ping and calls .Send, consistent with ICMP-based exfiltration.

Windows: Detect Runscripthelper.exe executing PowerShell scripts with 'surfacecheck'

Detects Runscripthelper.exe executions with "surfacecheck" in the command line on Windows.