Sigma detection rules, expert-reviewed

Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names

Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.

PowerShell on Windows adding Windows capabilities via Add-WindowsCapability

Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.

Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)

Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.

Windows Capability Added via PowerShell Add-WindowsCapability (OpenSSH)

Flags PowerShell commands that add Windows capabilities, specifically OpenSSH, via Add-WindowsCapability in logged script blocks.

Windows PowerShell Active Directory Module Import for Enumeration

Detects PowerShell importing Microsoft.ActiveDirectory.Management.dll with Import-Module, often seen during AD enumeration.

Windows PowerShell AD Module DLL Import for Active Directory Enumeration

Flags PowerShell importing Microsoft.ActiveDirectory.Management.dll via Import-Module, a common step in AD discovery and enumeration.

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Alerts on PowerShell module payloads containing commandlet/function names from known malicious exploitation and post-exploitation frameworks.

Windows: Suspicious child processes spawned by ManageEngine ServiceDesk Plus (java.exe parent)

Alerts when ManageEngine ServiceDesk Java spawns common attacker tools like PowerShell, certutil, mshta, or wmic.

PowerShell Data Exfiltration Using Audio File (WAV BinaryWriter) on Windows

Alerts on PowerShell script blocks that appear to write data into an audio (WAV) file for potential exfiltration.

Windows process creation: Suspicious child processes from WindowsApps directory

Alerts on suspicious cmd/PowerShell/mshta/rundll32-style child processes launched from Program Files\WindowsApps.

Windows Registry PowerShell ExecutionPolicy Tampering (Bypass/Unrestricted)

Alerts on Windows registry changes that set PowerShell ExecutionPolicy to Bypass or Unrestricted.

Windows Process Creation: PowerShell Execution Policy Registry Tampering via CommandLine

Alerts when a process command line references PowerShell ExecutionPolicy registry paths and weaker policy values.

Windows Process Creation: PowerShell Import-Module from Temp/AppData/Public Paths

Alerts on PowerShell Import-Module calls that load modules from Temp, AppData, or Public directories on Windows.

PowerShell script alias obfuscation via -Value (-join(...))

Flags PowerShell script blocks that set aliases using -Value with a (-join(...)) character-joining obfuscation pattern.

Windows PowerShell: Detect Set-Alias/New-Alias Usage in Script Block Logging

Alerts on PowerShell scripts that create aliases via Set-Alias/New-Alias, a common obfuscation technique, using ScriptBlockText logging.