Sigma detection rules, expert-reviewed

Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.

Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget

Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.

Windows PowerShell Invoke-WebRequest Download to Suspicious Paths

Alert when PowerShell uses Invoke-WebRequest/aliases with download flags and targets suspicious file locations.

Windows Suspicious Service Creation via sc.exe or PowerShell New-Service with Abnormal Binary Paths

Flags service creation commands (sc.exe/New-Service) when the specified binary path includes suspicious directories or script/loader utilities.

Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns

Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

Windows PowerShell: Import-Module From Temp, AppData, or Public Directories

Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.

PowerShell disables or removes ETW Trace via Set-EtwTraceProvider or Remove-EtwTraceProvider

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

Flags PowerShell script blocks invoking TroubleshootingPack with unattended answer-file arguments.

Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering

Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.

Windows: FakeUpdates/SocGholish execution via wscript loading a zip-based update script

Flags wscript launched from Temp update .js within a .zip to spawn cmd.exe or PowerShell on Windows.

Windows Registry Custom File Open Handler Executes PowerShell

Alerts when a registry shell open handler is created to run PowerShell with -command.

Windows PowerShell: Suspicious GPO Discovery via Get-GPO

Detects PowerShell script blocks using Get-GPO to enumerate domain Group Policy Objects.