Every published rule

PowerShell Spawned by wscript.exe or cscript.exe on Windows

Flags PowerShell launched by Windows script engines (wscript/cscript), excluding specific Health Service State activity.

Windows PowerShell execution with download-related command line patterns

Alerts when PowerShell is started with command-line fragments indicative of downloading remote content.

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

PowerShell Executed From AppData on Windows (Command Line Indicators)

Flags PowerShell command lines that include AppData paths (Local/Roaming), indicating possible user-profile script execution.

Windows PowerShell Base64-encoded shellcode in ScriptBlockText

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Flags PowerShell (powershell.exe/pwsh) process executions with command-line indicators consistent with XOR/obfuscated scripting.

Windows PowerShell Suspicious Encoded Command-Line Execution

Alerts on PowerShell launched with encoded-command switches and embedded encoded content patterns in the command line.

Windows Process Creation: PowerShell Command Execution Hidden in DLL Invocation

Flags DLL-invoking Windows binaries whose command lines include PowerShell execution strings.

PowerShell NTFS Alternate Data Stream Writes via set-content/add-content

Alerts on PowerShell Set/Add-Content operations that specify -Stream, indicating potential NTFS Alternate Data Stream writes.

Windows PowerShell Remote Thread Creation Into Uncommon Target Processes

Alerts on PowerShell creating remote threads in rundll32.exe or regsvr32.exe on Windows.

Windows File Events: Known Offensive PowerShell Script File Creation

Alerts on creation of known offensive PowerShell/PowerShell module filenames on Windows.

Windows Process Creation: Suspicious Child Programs Spawned by mshta, PowerShell, wscript, rundll32

Alerts when mshta/PowerShell and similar script hosts spawn tasks, download/transfer, or utility tools on Windows.

Windows Scheduled Task Creation via PowerShell Using schtasks.exe with ONLOGON/DAILY/ONIDLE/HOURLY

Flags PowerShell-launched schtasks.exe /Create commands matching default PowerSploit/Empire scheduled task persistence behavior.

PowerShell Credential Prompt via PromptForCredential

Flags PowerShell scripts that reference "PromptForCredential", indicating credential prompt behavior in Script Block Logging.

PowerShell downgrade indicators via EngineVersion=2. and HostVersion !=2. (Windows)

Detects PowerShell version mismatches that may indicate a downgrade attempt using EngineVersion vs HostVersion telemetry.

Windows PowerShell Web Access User-Agent Containing "WindowsPowerShell/" (Proxy Logs)

Alerts when proxy traffic shows a User-Agent containing "WindowsPowerShell/", consistent with PowerShell web access.

Windows Network Connections Initiated by PowerShell (powershell.exe or pwsh.exe)

Flags outbound network connections initiated by PowerShell on Windows, excluding common local and private IP ranges.

Windows PowerShell ScriptBlock with Encoded, Hidden, or Noninteractive Execution Parameters

Alerts on PowerShell ScriptBlockText containing encoded command, hidden window, or noninteractive execution parameters.

Suspicious PowerShell Module Execution Using Encoded, Hidden, or Noninteractive Context (Windows)

Alerts on PowerShell module executions using encoded commands, hidden windows, or noninteractive flags to evade visibility and interaction.

Suspicious PowerShell Script Block Invocations Using Encoded/Hidden Execution and Persistence Commands

Flags PowerShell script blocks using hidden/non-interactive execution, encoded/decode patterns, iex execution, web downloads, or run key modifications.