Every published rule

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)

Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.

Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process

Alerts when a non-PowerShell executable loads System.Management.Automation.dll on Windows, indicating possible PowerShell execution in another process.

Windows Process Creation: Detect Obfuscated PowerShell IEX Invocation from Invoke-Obfuscation

Detects PowerShell commands showing obfuscation markers consistent with Invoke-Obfuscation-powered IEX invocation.

PowerShell: Obfuscated IEX Invocation via Invoke-Obfuscation String/Variable Patterns

Alerts on obfuscated PowerShell IEX invocation strings built from Invoke-Obfuscation style concatenation patterns in ScriptBlockText.

PowerShell Module Obfuscated IEX Invocation via Invoke-Obfuscation Payload Patterns

Alerts when PowerShell module payloads contain patterns consistent with obfuscated IEX generation via Invoke-Obfuscation.

Windows System Service Creation of Obfuscated PowerShell IEX (Invoke-Obfuscation)

Flags Windows service creations whose ImagePath contains obfuscated PowerShell IEX invocation strings.

Windows Security: Detect Obfuscated PowerShell IEX Invocation via ServiceFileName Patterns (Event ID 4697)

Alerts on EventID 4697 instances where ServiceFileName matches obfuscated IEX-style PowerShell invocation patterns consistent with Invoke-Obfuscation.

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Flags PowerShell ScriptBlockText that combines Empire process-control indicators with dnscat DNS tunneling commands.

Windows PowerShell Script Execution from Alternate Data Stream (ADS)

Flags PowerShell processes using Get-Content -Stream to execute or retrieve script content from an ADS.

Windows PowerShell Audio Capture Cmdlets: Toggle/Get/Set/Write AudioDevice

Flags PowerShell command lines referencing audio device cmdlets used to get/toggle/set/write audio device settings.

Windows PowerShell ScriptBlock Web Request Cmdlets and Command-Line Tools

Alerts when PowerShell script blocks reference web request and download cmdlets/commands, excluding a specific guest configuration path.

Windows PowerShell Profile File Creation or Modification

Alerts on creation or modification of PowerShell profile.ps1 files in typical Windows and PowerShell 7 locations.

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.

PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Detects PowerShell script blocks that modify Winlogon helper registry keys via Set-ItemProperty or New-Item on Windows.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.