Sigma detection rules, expert-reviewed

Windows Registry Run Key Entries Containing PowerShell Execution Strings

Alerts when registry Run key value data contains PowerShell launch or encoded download/execution strings on Windows.

Windows PowerShell: Suspicious Process Discovery Using Get-Process

Alerts when PowerShell script blocks contain Get-Process, indicating local process discovery activity.

PowerShell Password Policy Discovery via Get-AdDefaultDomainPasswordPolicy (Windows)

Alerts when PowerShell calls Get-AdDefaultDomainPasswordPolicy to enumerate an AD domain’s default password policy.

Windows PowerShell Directory Enumeration via Get-ChildItem and Output Redirection

Flags PowerShell directory enumeration patterns using Get-ChildItem, error suppression, and appended output to a file.

Windows PowerShell Active Directory Group Enumeration via Get-AdGroup Cmdlet

Flags PowerShell script blocks that call Get-ADGroup with -Filter to enumerate Active Directory groups.

PowerShell: Active Directory computer enumeration via Get-AdComputer

Flags PowerShell script blocks using Get-ADComputer with enumeration-related parameters for AD computer discovery.

PowerShell Get-ADUser Enumeration Using UserAccountControl DONT_REQ_PREAUTH Flag

Flags Get-ADUser PowerShell scripts enumerating accounts by UserAccountControl DONT_REQ_PREAUTH (4194304).

Windows PowerShell: Suspicious Get-ADDBAccount access to ntds.dit via BootKey and DatabasePath

Alerts on PowerShell invocations of Get-ADDBAccount that reference BootKey and DatabasePath for ntds.dit credential access.

PowerShell Base64 Encoded MpPreference Command Lines for Windows Defender Modification

Detects PowerShell Base64 command lines referencing Add-MpPreference/Set-MpPreference to modify Microsoft Defender AV settings.

Windows PowerShell: Disable Microsoft Defender Scanning via Set-MpPreference

Flags PowerShell commands that disable Microsoft Defender scanning/protection settings using Set-MpPreference, including encoded variants.

Windows: fsutil SymlinkEvaluation behavior modification via command line

Alerts on fsutil commands from cmd/PowerShell that change NTFS SymlinkEvaluation behavior, potentially enabling remote symlink access.

Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load

Flags PowerShell command lines containing Base64 fragments consistent with reflective .NET Assembly.Load usage.

Windows BITS Job Creation Triggered by PowerShell

Flags new BITS job creation on Windows when initiated by PowerShell (Event ID 3).

Windows PowerShell CommandLine downloads and executes via WebClient with IEX or DownloadFile

Alerts on PowerShell command lines that use WebClient downloads combined with IEX or DownloadFile, typical of staged payload execution.

Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands

Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.