Every published rule

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.

Windows Named Pipe Created for PowerShell PSHost Instance

Alerts on named pipe creation with a \PSHost prefix, indicating PowerShell host-related activity.

Windows Named Pipe Creation: Alternate PowerShell Host via \PSHost

Alerts on creation of \PSHost named pipes to identify alternate PowerShell host usage via Windows pipe events.

Windows: WinRM inbound network connections to ports 5985/5986 for PowerShell remoting

Alerts on WinRM inbound connections (ports 5985/5986) consistent with remote PowerShell remoting activity.

Windows Process Creation: Empire PowerShell UAC Bypass CommandLine Pattern

Flags Windows process creation events running Empire-style PowerShell UAC bypass command fragments.

PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

Uncommon PowerShell HostApplication Values in Windows PowerShell Start Logs

Detects PowerShell classic start events with unusual HostApplication values that may indicate evasion of powershell.exe-focused detections.

Windows Remote PowerShell Session via PS Module ContextInfo and wsmprovhost.exe

Flags Windows PowerShell remote session module context involving wsmprovhost.exe while filtering out archive module references.

Windows Remote PowerShell via PS Classic (wsmprovhost.exe, HostName=ServerRemoteHost)

Flags Windows telemetry indicating a remote PowerShell session startup using wsmprovhost.exe with a specified host parameter.

Windows: MMC spawning command-line executables

Flags cases where mmc.exe starts command-line tools like cmd, PowerShell, script hosts, or BITSADMIN.

Windows PowerShell Script Block Logging: Nishang Commandlet Names and Arguments

High-severity alert on PowerShell script blocks that reference known Nishang commandlets and exfil/execution helper names.

Windows PowerShell Process Creation With Empire-Style EncodedCommand Launch Parameters

Flags PowerShell command lines containing hidden/stealth and encoded Empire-style launch parameters on Windows.

Suspicious PowerShell/WScript Activity in WMI Event Consumer Commands

Identifies WMI event consumer commands containing PowerShell/WScript download-and-execute patterns like Net.WebClient and IEX.

WmiPrvSE.exe Spawned PowerShell Child Process on Windows

Alerts on PowerShell spawning from WmiPrvSE.exe, a possible indicator of WMI-based remote execution.

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

Windows PowerShell Script Block Matches Common Reflection and Injection Keywords

Alerts on PowerShell script block text containing reflection, dynamic assembly loading, and injection-related keywords.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).