Every published rule

Windows Process Creation: PowerShell Obfuscation Executed via Clip.exe and Clipboard

Flags Windows command lines indicating clip.exe clipboard use followed by obfuscated PowerShell invoke behavior.

PowerShell Script Obfuscation Triggered by Use of clip.exe and Clipboard Invocation

Flags PowerShell Script Block Logging containing clip.exe/clipboard chaining and clipboard-driven execution markers.

PowerShell module obfuscation using clip.exe with echo and clipboard invocation

Flags obfuscated PowerShell module scripts that echo “clip” and invoke clipboard-related behavior.

Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content

Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows Security EID 4697: mshta Used to Run Obfuscated VBScript PowerShell

Detects service creation where the binary path includes mshta plus VBS/automation indicators consistent with script-based obfuscation.

Windows Security 4697: Obfuscated PowerShell via use of Clip.exe from scripts

Alerts on EID 4697 service installations where the service file name matches Clip/clipboard indicators tied to obfuscated PowerShell.

Windows: Code Execution via Pester.bat Using PowerShell Help or cmd.exe

Flags Windows process executions that invoke Pester-related help/commands via PowerShell or cmd, consistent with Pester.bat usage.

Windows Process Execution: Obfuscated PowerShell Invocation Using mshta with VBScript CreateObject

Flags Windows process command lines containing an obfuscated PowerShell+MSHTA VBScript execution pattern.

PowerShell share removal via Remove-SmbShare or Remove-FileShare on Windows

Flags PowerShell commands that remove SMB or file shares through Remove-SmbShare/Remove-FileShare.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

PowerShell Service Persistence via Registry ImagePath on Windows

Flags Windows registry service ImagePath entries that reference PowerShell (powershell/pwsh).

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

PowerShell Remote Thread Creation (Windows CreateRemoteThread)

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.