Sigma detection rules, expert-reviewed

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

Windows PowerShell Script Accessing Windows MailApp MailBox Data Path

Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.

PowerShell Registry Reconnaissance Indicators on Windows via Script Block Logging

Identifies PowerShell script blocks querying sensitive registry keys tied to services and Run/Explorer/winlogon locations.

Windows PowerShell Decryption-Like Activity Involving .LNK File Processing

Identifies PowerShell runs that enumerate and process *.lnk content using byte-level reads/writes consistent with decryption staging.

Windows: PowerShell Core DLL Loaded by Office Application

Flags Office apps that load System.Management.Automation DLLs associated with PowerShell Core.

Windows File Events: PSScriptPolicyTest Script Creation by Uncommon Process

Alert on __PSScriptPolicyTest_ PowerShell script file creation when the writing process is not an expected PowerShell component.

Windows rundll32.exe Execution via cmd/cscript/powershell with .dll and Suspicious Directories

Alerts on rundll32.exe execution with DLL arguments from common Windows script/LOLBins and suspicious staging paths.

PowerShell Certificate Export Cmdlets in Windows Process Creation

Flags PowerShell command lines invoking certificate export cmdlets (Export-PfxCertificate/Export-Certificate) on Windows.

PowerShell ScriptBlock Function Get-VMRemoteFXPhysicalVideoAdapter Module Creation

Flags PowerShell module content that defines Get-VMRemoteFXPhysicalVideoAdapter in a ScriptBlock, consistent with load-order abuse patterns.

Windows: New PowerShell Module Files Created by Non-PowerShell Processes

Detects new PowerShell module files written into Modules directories by processes other than expected PowerShell hosts.

Windows PowerShell Module File Creation via PowerShell Processes

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.