Sigma detection rules, expert-reviewed

PowerShell ScriptBlock launching redirected comspec to Alternate Data Stream via '>'

Flags PowerShell script blocks using Start-Process with comspec and " > " redirection consistent with ADS-style file hiding.

PowerShell discovery of Win32_PnPEntity via ScriptBlockText

Alerts when PowerShell script blocks reference Win32_PnPEntity to enumerate attached Plug and Play devices.

PowerShell Write-Hijack HackTool Creates .bat for DLL Hijack Execution (Windows)

Flags PowerShell creating .bat files consistent with PowerUp Write-Hijack DLL abuse on Windows.

PowerShell WMI Event Subscription Persistence via New-CimInstance

Finds PowerShell creating WMI __EventFilter and CommandLineEventConsumer objects for event-triggered persistence.

Windows PowerShell: Add-Content to $profile for Potential Persistence

Detects PowerShell Add-Content writing to $profile, especially when paired with common command-loading or execution payloads.

PowerShell ShellIntel Commandlet Abuse via ScriptBlock Logging

Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.

Successful ProxyShell-like Exchange exploitation via autodiscover.json and PowerShell/MAPI paths

Flags Exchange-targeted web requests with /autodiscover.json plus exploit URI fragments returning 200/301.

Detects ProxyShell-Style Exchange Probing via /autodiscover.json and PowerShell URIs (HTTP 401)

Flags Exchange web requests with ProxyShell-like /autodiscover.json query patterns and PowerShell/EWS-related parameters, often returning HTTP 401.

PowerShell timestomping via file timestamp property and setter usage (Windows)

Identifies PowerShell timestomping attempts by matching script text that sets file creation, access, and write timestamps.

PowerShell Virtualization Environment Discovery via WMI in ScriptBlockLogging (Windows)

Identifies PowerShell WMI queries for Win32 computer system and ACPI thermal data used to check virtualization environments.

Windows PowerShell Recon via Export-Oriented Commands in Script Block Logging

Detects PowerShell script blocks performing recon queries (services/processes) and writing output to TEMP.

PowerShell Keylogging via Get-Keystrokes and Win32 API Calls (GetAsyncKeyState, GetForegroundWindow)

Flags PowerShell script blocks containing Get-Keystrokes with GetAsyncKeyState/GetForegroundWindow for potential keylogging.

PowerShell SAM Hive Copy via Volume Shadow Copy Paths on Windows

Flags PowerShell commands that copy the SAM hive from Volume Shadow Copy locations using .NET or PowerShell copy semantics.

PowerShell Script Block Collection of Documents via Recursive Get-ChildItem

Alerts on PowerShell file enumeration that recursively searches and includes common document extensions via Get-ChildItem.

Windows PowerShell Script Block Local Email Collection via Outlook COM Automation

Flags PowerShell script block text referencing Outlook COM automation used to collect locally stored email.