Sigma detection rules, expert-reviewed

Windows Process Creation: net.exe or PowerShell creating AD group "ESX Admins"

Alerts on net.exe or PowerShell attempts to create a domain group named "ESX Admins" via AD/command-line parameters.

PowerShell Launch With --headless From Conhost.exe on Windows

Flags headless ConHost launching PowerShell on Windows based on process name and command-line arguments.

Suspicious PowerShell Execution of DSInternals Cmdlets on Windows

Flags PowerShell command lines invoking specific DSInternals cmdlets that can support AD/credential and key material operations.

Windows PowerShell ScriptBlock alerts for DSInternals cmdlets

Triggers when PowerShell script blocks include DSInternals cmdlets tied to AD/Azure AD key and password auditing or manipulation.

Suspicious Child Process of KeyScrambler.exe on Windows

Alerts on KeyScrambler.exe launching cmd.exe, PowerShell, script hosts, regsvr32, or rundll32 as child processes.

PowerShell Start-NetEventSession Script Block Execution Indicating Potential Network Capture (Windows)

Alerts when PowerShell ScriptBlocks reference Start-NetEventSession, indicating potential network packet or event capture.

Windows PowerShell ScriptBlock Adds Allow Firewall Rule via New-NetFirewallRule

Flags PowerShell ScriptBlock text that invokes New-NetFirewallRule to add an Allow firewall rule.

PowerShell New-NetFirewallRule Adds Windows Allow Firewall Rule

Alert on PowerShell creating a new Windows firewall rule that sets the action to Allow via New-NetFirewallRule.

Windows Process Creation: Forest Blizzard-related hashes and scheduled task activity

Detects suspicious Windows process execution tied to known hashes or schtasks/PowerShell command-line patterns used for staging and compression.

Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows

Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.

Windows: User Added to Highly Privileged Local/Directory Groups via net.exe or Add-LocalGroupMember

Flags net.exe or PowerShell commands adding users to privileged groups like Group Policy Creator Owners or Schema Admins.

Suspicious File Downloads via PowerShell.EXE from File Sharing Domains on Windows

Flags PowerShell downloading content from known file-sharing/paste domains using DownloadString/DownloadFile or web request syntax.

Windows PowerShell ScriptBlock keyword match for WinPwn tool usage

Alerts when PowerShell ScriptBlock text contains WinPwn execution or script/file reference keywords.

Windows Registry Set in Shell Open Command Using PowerShell Cryptography .NET Classes

Flags registry set of \Shell\Open\Command where PowerShell references System.Security.Cryptography crypto classes.

PowerShell Crypto Namespace Class Invocation for Windows Process Creation

Alerts on PowerShell executions that reference System.Security.Cryptography and common crypto class names.