Sigma detection rules, expert-reviewed

Windows Capability Added via PowerShell Add-WindowsCapability (OpenSSH)

Flags PowerShell commands that add Windows capabilities, specifically OpenSSH, via Add-WindowsCapability in logged script blocks.

Windows PowerShell Active Directory Module Import for Enumeration

Detects PowerShell importing Microsoft.ActiveDirectory.Management.dll with Import-Module, often seen during AD enumeration.

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

PowerShell Data Exfiltration Using Audio File (WAV BinaryWriter) on Windows

Alerts on PowerShell script blocks that appear to write data into an audio (WAV) file for potential exfiltration.

Windows process creation: Suspicious child processes from WindowsApps directory

Alerts on suspicious cmd/PowerShell/mshta/rundll32-style child processes launched from Program Files\WindowsApps.

Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)

Alerts on Windows registry changes that set PowerShell ExecutionPolicy to Bypass or Unrestricted.

Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine

Alerts when a process command line references PowerShell ExecutionPolicy registry paths and weaker policy values.

Windows Process Creation: PowerShell Import-Module from Temp/AppData/Public Paths

Alerts on PowerShell Import-Module calls that load modules from Temp, AppData, or Public directories on Windows.

PowerShell script alias obfuscation via -Value (-join(...))

Flags PowerShell script blocks that set aliases using -Value with a (-join(...)) character-joining obfuscation pattern.

Windows PowerShell Script Block Alerts for Set-Alias and New-Alias Usage

Alerts on PowerShell scripts that create aliases via Set-Alias/New-Alias, a common obfuscation technique, using ScriptBlockText logging.

Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns

Detects suspicious PowerShell process command lines using hidden/no-profile, execution-policy bypass, and encoded/Base64 or IEX WebClient download patterns.

Windows PowerShell: ScriptBlock using security descriptor (Win32_Trustee/Win32_Ace) and LSA data strings

Alerts on PowerShell ScriptBlock text that manipulates security descriptors and LSA-related identifiers, indicating possible persistence behavior.

Windows PowerShell Keylogger Function Reference in Script Block Logging

Alerts on PowerShell script blocks containing keyboard IsKeyDown references associated with potential keystroke capture.