Sigma detection rules, expert-reviewed

Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.

Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend

Flags webserver POSTs returning 200 that request both /owa/mastermailbox and /powershell, consistent with OWASSRF exploitation attempts.

Detect OWASSRF Webserver Exploitation Pattern Targeting PowerShell Backend

Alerts on successful POST requests to OWA URLs containing PowerShell backend indicators and Exchange-like probe user agents.

Detects OWASSRF Proxy Exploitation Attempt via OWA to PowerShell Backend

Identifies proxy POSTs that return 200 and request both /owa/mastermailbox and /powershell, indicating potential OWASSRF exploitation.

Potential OWASSRF Exploitation via OWA Proxy Requests (HTTP 200) - Exchange

Alerts on 200-status proxy POSTs targeting OWA-to-PowerShell backend paths with encoded user info markers.

Windows Registry Set Detection of Suspicious Environment Variable Commands

Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.

Windows PowerShell nslookup DNS TXT Download Cradle

Identifies PowerShell launching an nslookup-based cradle that queries TXT records with HTTP-related nslookup parameters.

Windows: Elevated PowerShell or CMD Spawned from Uncommon Parent Location

Alerts on elevated PowerShell/CMD executions whose parent process comes from uncommon Windows locations, indicating likely privilege escalation.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).

Windows process creation: suspicious ping wait followed by del file deletion

Flags cmd/powershell command lines that use ping -n with Nul redirection followed by Del /f /q to delete a file.

Windows Exchange PowerShell Cmdlet History Log Files Deleted

Flags deletion of Exchange PowerShell cmdlet history log files in the expected logging directory.

PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services

Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.