Sigma detection rules, expert-reviewed

Windows PowerShell Import-Module Cmdlet Execution

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

PowerShell Script Reading Files and Resolving DNS Host Entries

Identifies PowerShell scripts that read files, resolve DNS host entries, and output results to disk.

Windows: Suspicious child processes spawned from Veeam SQL Server service

Alerts on suspicious cmd/PowerShell/LOLBin and recon utilities spawned by the Veeam SQL service (sqlservr.exe with VEEAMSQL).

Windows PowerShell Credential Dumping Script Targeting Veeam Backup ProtectedStorage

Alerts on PowerShell scripts that reference Veeam protected storage and credential extraction indicators, enabling stored credential dumping on Windows.

Windows PowerShell Script Block Matching POWERTRASH Behavior Indicators

Detects PowerShell ScriptBlock text containing POWERTRASH-related in-memory and dynamic execution indicators on Windows.

PowerShell ScriptBlock Launching wscript.exe via PowerHold-like Code Patterns on Windows

Flags PowerShell ScriptBlock text that writes staged bytes in APPDATA and launches wscript.exe.

Windows PowerShell Script File Creation Matching FIN7-Style Filenames

Alerts on Windows PowerShell script drops named host_ip.ps1 or ending with _64refl.ps1.

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Identifies PowerShell ScriptBlock content that includes Rubeus-specific Kerberos and ticket manipulation flags.

Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)

Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.

Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.

Windows: Detect suspicious PowerShell/Lsass tool execution launched by ManageEngine (ServiceDesk)

Alerts on suspicious child PowerShell/LSASS/tool activity launched by ManageEngine ServiceDesk (Java parent) on Windows.

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.

Windows: Detect Action1 agent deployment, command execution, and remote session startup

Finds Action1 agent deployments, script-launched command/PowerShell execution, and remote session starts on Windows.

Windows PowerShell File Dropper Activity: Creating Executables or Script Files

Alerts when PowerShell writes .exe/.dll or script-like files, consistent with binary/script staging or dropping.

Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.