Sigma detection rules, expert-reviewed

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Alerts on Windows process launches whose command line includes well-known malicious PowerShell commandlet names.

Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features

Alerts on PowerShell Enable-WindowsOptionalFeature used with -Online to enable listed optional features.

Windows PowerShell Token Obfuscation via Process Command Line

Identifies Windows PowerShell command lines using token obfuscation patterns, common in Invoke-Obfuscation.

Windows PowerShell script token obfuscation via backtick and dynamic expression patterns

Find PowerShell script blocks that show token obfuscation patterns resembling Invoke-Obfuscation behavior.

Windows PowerShell Inline Execution via File Reads and Raw Parameters

Alerts on PowerShell command lines that inline-execute content read from files using -raw.

Windows Process Creation: PowerShell COM CLSID Download Cradles

Alerts on PowerShell command lines using GetTypeFromCLSID with selected CLSIDs that may be used to download files via COM.

PowerShell ScriptBlock COM CLSID GetTypeFromCLSID Download Cradle Indicators

Alerts on PowerShell script blocks using GetTypeFromCLSID with specific CLSIDs indicative of COM-based download cradles.

Windows PowerShell: In-Memory Assembly Loading via Reflection.Assembly

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Detects AgentExecutor.exe command lines that trigger PowerShell script execution, including remediations and potentially bypassed ExecutionPolicy.

Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation

Alerts on AgentExecutor.exe launches that pass -powershell/-remediationScript to run PowerShell (including bypass execution policy).

PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows

Windows process command lines using PowerShell FromBase64String with MemoryStream and Gzip-like Base64 markers (H4sI) are flagged.

Windows PowerShell Execution of AADInternals Cmdlets (process creation)

Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.

Suspicious X509Enrollment usage in Windows PowerShell scripts

Alerts on PowerShell script blocks containing X509Enrollment.CBinaryConverter and a specific enrollment GUID.

PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream

Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.

Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution

Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.