Sigma detection rules, expert-reviewed

Windows: New-ADServiceAccount Creates Delegated Service Account in Target OUs

Alerts on PowerShell runs of New-ADServiceAccount to create a delegated service account with -CreateDelegatedServiceAccount and -path.

Windows PowerShell Modifies dMSA msDS-ManagedAccountPrecededByLink Attributes

Flags PowerShell script content modifying msDS-ManagedAccountPrecededByLink (dMSA link attributes) via AD link changes.

PowerShell dMSA Service Account Creation in Target OUs via New-ADServiceAccount

Alerts on PowerShell creating a delegated service account via New-ADServiceAccount with -CreateDelegatedServiceAccount and -path.

Windows: Suspicious child processes spawned by CrushFTP service

Alerts when CrushFTP service (crushftpservice.exe) launches shell/script executables like PowerShell, cmd, mshta, or bash.

Windows Process Creation: Disabling Security Logging via MiniNt Registry Key Set

Flags reg.exe or PowerShell commands that create/modify the MiniNt registry key to impair Windows event logging.

Windows PowerShell History File Access Attempt via ConsoleHost_history.txt

Alerts on Windows process executions whose command line references PowerShell console history files or HistorySavePath.

Windows PowerShell ScriptBlock: Get-ADComputer reconnaissance for unconstrained delegation properties

Flags PowerShell script blocks that query AD computer delegation-related properties using Get-ADComputer-style discovery.

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Alerts on schtasks.exe task creation commands that simultaneously include curl download indicators and PowerShell execution.

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Flags conhost.exe spawning command/scripting utilities like PowerShell, MSHTA, or regsvr32.exe.

Windows Process Creation: Suspicious cmd.exe Launch with Encoded PowerShell from Cleo Suite

Alerts on cmd.exe launching PowerShell encoded commands from Cleo javaw.exe components with .Download.

Windows Registry RunMRU PowerShell or WMIC Execution Command Indicators

Alerts on RunMRU registry entries showing PowerShell (encoding/invocation) or WMIC shadowcopy/process call usage.

Windows MeshAgent remote command execution via cmd.exe or PowerShell child processes

Flags cmd.exe or PowerShell spawned by meshagent.exe on Windows, indicating potential remote command execution.

Windows DISM Enables PowerShell Web Access Feature via Command Line

Flags DISM executions that enable the WindowsPowerShellWebAccess feature using /online and /enable-feature parameters.

Windows PowerShell Web Access Installation via PowerShell Script Block

Detects PowerShell Web Access installation and web authorization configuration from Windows PowerShell script blocks.

Windows Remote Thread Creation in cmd.exe or PowerShell.exe

Alert on remote thread creation where cmd.exe or PowerShell.exe is the initiating process, excluding common system and Defender sources.