Sigma detection rules, expert-reviewed

PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.

PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)

Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.

PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features

Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.

Windows PowerShell DNS TXT Download Cradle via nslookup (Process Creation)

Flags PowerShell spawning nslookup configured to query DNS TXT records as a download cradle.

Windows Process Creation: Suspicious Service Stop/Pause/Delete/Disable via net, sc, PowerShell

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows Process Execution: Suspicious PowerShell Encoded Command with Exec Bypass

Flags Windows process creations with a bypass-and-encoded PowerShell Start-Job command-line pattern linked to Mercury-related activity.

Windows process command line matching Sliver C2 implant NoExit PowerShell UTF8 pattern

Alerts on Windows process command lines matching a Sliver-style PowerShell -NoExit encoding pattern.

Windows File Changes to Microsoft.VSCode_profile.ps1 via PowerShell Profile

Detects creation or modification of Microsoft.VSCode_profile.ps1 based on Windows file events.

Windows PowerShell Command History Disable via Remove-Module psreadline

Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.

Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.

Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings

Alerts on PowerShell ScriptBlock content referencing Group Policy policy keys and specific security policy value names.

PowerShell Write-EventLog with -RawData Flag

Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.