Sigma detection rules, expert-reviewed

Windows PowerShell ScriptBlock with Encoded, Hidden, or Noninteractive Execution Parameters

Alerts on PowerShell ScriptBlockText containing encoded command, hidden window, or noninteractive execution parameters.

Suspicious PowerShell Module Execution Using Encoded, Hidden, or Noninteractive Context (Windows)

Alerts on PowerShell module executions using encoded commands, hidden windows, or noninteractive flags to evade visibility and interaction.

Windows BITSAdmin File Download via bitsadmin.exe with Transfer/Addfile Arguments

Flags bitsadmin.exe being started with parameters consistent with transferring/downloading files from an http URL.

Windows Security: Detects SAM User/Group Access During Domain Recon (Event ID 4661)

Alerts on Event ID 4661 accesses to SAM user/group objects for domain Administrator and Domain Admins.

Windows Service Install: NtsSrv (StoneDrill) via Service Control Manager Event 7045

Flags Windows service installs of NtsSrv by Service Control Manager with an ImagePath ending in " LocalService".

Suspicious PowerShell Script Block Invocations Using Encoded/Hidden Execution and Persistence Commands

Flags PowerShell script blocks using hidden/non-interactive execution, encoded/decode patterns, iex execution, web downloads, or run key modifications.

PowerShell ScriptBlock WebClient Download Calls

Alert on PowerShell ScriptBlock text that uses System.Net.WebClient to download files or strings from the Internet.

Windows PowerShell Script Block Logging: PSAttack marker string

Alerts when PowerShell script blocks contain the "PS ATTACK!!!" marker on Windows.

Windows PowerShell Script Block Contains Exploitation Framework and Credential Theft Keywords

Alerts on PowerShell script block text containing known exploitation, token, and memory-related keywords.

Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Alerts when PowerShell ScriptBlock text includes strings matching known malicious commandlets from common exploitation toolsets.

Suspicious PowerShell Module Usage with Hidden/Encoded Execution Parameters on Windows

Flags hidden or encoded PowerShell invocations that decode/execute code or download-and-execute patterns, while filtering a Chocolatey installer snippet.

Suspicious PowerShell WebClient Downloads via PoshModule

Alerts on PowerShell module activity referencing System.Net.WebClient with DownloadFile/DownloadString calls to fetch remote content.

Windows PowerShell Execution via EngineVersion/HostVersion Mismatch in Command Start Telemetry

Detects PowerShell execution attempts that match a specific executable EngineVersion/HostVersion mismatch pattern on Windows.

PowerShell Net.WebClient DownloadFile/DownloadString Usage (Classic)

Flags PowerShell Classic commands using Net.WebClient to download content via DownloadFile or DownloadString.

Windows System Service Execution of Credential Dumping Tools (Service Control Manager Event 7045)

Flags Service Control Manager service creation with ImagePath names tied to credential dumping tools (Event ID 7045).