Sigma detection rules, expert-reviewed

Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns

Detects suspicious PowerShell process command lines using hidden/no-profile, execution-policy bypass, and encoded/Base64 or IEX WebClient download patterns.

Windows PowerShell: ScriptBlock using security descriptor (Win32_Trustee/Win32_Ace) and LSA data strings

Alerts on PowerShell ScriptBlock text that manipulates security descriptors and LSA-related identifiers, indicating possible persistence behavior.

Windows PowerShell Keylogger Function Reference in Script Block Logging

Alerts on PowerShell script blocks containing keyboard IsKeyDown references associated with potential keystroke capture.

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Alerts on Windows process launches whose command line includes well-known malicious PowerShell commandlet names.

Windows: PowerShell Enable-WindowsOptionalFeature Enables Suspicious Optional Features

Alerts on PowerShell Enable-WindowsOptionalFeature used with -Online to enable listed optional features.

Windows PowerShell Token Obfuscation via Process Command Line

Identifies Windows PowerShell command lines using token obfuscation patterns, common in Invoke-Obfuscation.

Windows PowerShell script token obfuscation via backtick and dynamic expression patterns

Find PowerShell script blocks that show token obfuscation patterns resembling Invoke-Obfuscation behavior.

Windows PowerShell Inline Execution via File Reads and Raw Parameters

Alerts on PowerShell command lines that inline-execute content read from files using -raw.

Windows Process Creation: PowerShell COM CLSID Download Cradles

Alerts on PowerShell command lines using GetTypeFromCLSID with selected CLSIDs that may be used to download files via COM.

PowerShell ScriptBlock COM CLSID GetTypeFromCLSID Download Cradle Indicators

Alerts on PowerShell script blocks using GetTypeFromCLSID with specific CLSIDs indicative of COM-based download cradles.

Windows PowerShell In-Memory Assembly Loading via Reflection.Assembly::Load

Flags PowerShell script blocks that reference [Reflection.Assembly]::load for potential in-memory assembly loading.

Windows Process Execution: Suspicious AgentExecutor.exe PowerShell Launch with ExecutionPolicy Bypass

Detects AgentExecutor.exe command lines that trigger PowerShell script execution, including remediations and potentially bypassed ExecutionPolicy.

Windows AgentExecutor.exe PowerShell Execution (ExecutionPolicy Bypass) Process Creation

Alerts on AgentExecutor.exe launches that pass -powershell/-remediationScript to run PowerShell (including bypass execution policy).

PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows

Windows process command lines using PowerShell FromBase64String with MemoryStream and Gzip-like Base64 markers (H4sI) are flagged.

Windows PowerShell Execution of AADInternals Cmdlets (process creation)

Flags PowerShell processes running AADInternals “-AADInt” cmdlets, indicating potential Azure AD/Office 365 administration or abuse.