Sigma detection rules, expert-reviewed

Windows: New PowerShell Module Files Created by Non-PowerShell Processes

Detects new PowerShell module files written into Modules directories by processes other than expected PowerShell hosts.

Windows PowerShell Module File Creation via PowerShell Processes

Alert when PowerShell creates module-related files under WindowsPowerShell or PowerShell 7 module directories.

Windows PowerShell dropping a .ps1 script from powershell.exe or pwsh.exe

Alerts when PowerShell creates a dropped .ps1 script file on Windows, excluding common benign temp and test outputs.

Windows PowerShell Import-Module Cmdlet Execution

Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.

PowerShell Script Reading Files and Resolving DNS Host Entries

Identifies PowerShell scripts that read files, resolve DNS host entries, and output results to disk.

Windows: Suspicious child processes spawned from Veeam SQL Server service

Alerts on suspicious cmd/PowerShell/LOLBin and recon utilities spawned by the Veeam SQL service (sqlservr.exe with VEEAMSQL).

Windows PowerShell Credential Dumping Script Targeting Veeam Backup ProtectedStorage

Alerts on PowerShell scripts that reference Veeam protected storage and credential extraction indicators, enabling stored credential dumping on Windows.

Windows PowerShell Script Block Matching POWERTRASH Behavior Indicators

Detects PowerShell ScriptBlock text containing POWERTRASH-related in-memory and dynamic execution indicators on Windows.

PowerShell ScriptBlock Launching wscript.exe via PowerHold-like Code Patterns on Windows

Flags PowerShell ScriptBlock text that writes staged bytes in APPDATA and launches wscript.exe.

Windows PowerShell Script File Creation Matching FIN7-Style Filenames

Alerts on Windows PowerShell script drops named host_ip.ps1 or ending with _64refl.ps1.

Rubeus HackTool Execution via PowerShell ScriptBlock Flags (Windows)

Identifies PowerShell ScriptBlock content that includes Rubeus-specific Kerberos and ticket manipulation flags.

Windows Process Creation Indicators for PowerShell MSI Download and Silent Install (PaperCut MF/NG)

Detects hidden PowerShell downloading a setup.msi and silent msiexec installation tied to PaperCut MF/NG exploitation indicators.

Windows PowerShell Invoke-WebRequest Execution via Direct IP in Command Line

Alerts when PowerShell executes web-request aliases targeting direct IP URLs, indicating possible remote content access.

Windows: Detect suspicious PowerShell/Lsass tool execution launched by ManageEngine (ServiceDesk)

Alerts on suspicious child PowerShell/LSASS/tool activity launched by ManageEngine ServiceDesk (Java parent) on Windows.

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.