Sigma detection rules, expert-reviewed

Suspicious X509Enrollment usage in Windows PowerShell scripts

Alerts on PowerShell script blocks containing X509Enrollment.CBinaryConverter and a specific enrollment GUID.

PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream

Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.

Windows PowerShell Script Block Logging: AADInternals Cmdlets (Add-AADInt to Update-AADInt) Execution

Flags PowerShell script block execution that contains AADInternals cmdlet names (AADInt), indicating potential admin or abuse activity.

Windows: Explorer opened from cmd.exe/powershell using shell:MyComputerFolder shortcut

Flags explorer.exe opened for My Computer via shell:mycomputerfolder when started by cmd or PowerShell.

Webserver: OWASSRF exploitation attempt via OWA to PowerShell backend

Flags webserver POSTs returning 200 that request both /owa/mastermailbox and /powershell, consistent with OWASSRF exploitation attempts.

Detect OWASSRF Webserver Exploitation Pattern Targeting PowerShell Backend

Alerts on successful POST requests to OWA URLs containing PowerShell backend indicators and Exchange-like probe user agents.

Detects OWASSRF Proxy Exploitation Attempt via OWA to PowerShell Backend

Identifies proxy POSTs that return 200 and request both /owa/mastermailbox and /powershell, indicating potential OWASSRF exploitation.

Potential OWASSRF Exploitation via OWA Proxy Requests (HTTP 200) - Exchange

Alerts on 200-status proxy POSTs targeting OWA-to-PowerShell backend paths with encoded user info markers.

Windows Registry Set Detection of Suspicious Environment Variable Commands

Flags Windows registry environment variable registrations that include PowerShell and base64-encoded command fragments.

Windows PowerShell nslookup DNS TXT Download Cradle

Identifies PowerShell launching an nslookup-based cradle that queries TXT records with HTTP-related nslookup parameters.

Windows: Elevated PowerShell or CMD Spawned from Uncommon Parent Location

Alerts on elevated PowerShell/CMD executions whose parent process comes from uncommon Windows locations, indicating likely privilege escalation.

PowerShell Get-ADUser User Discovery and Data Export via File Output

Detects PowerShell Get-ADUser-based user enumeration combined with exporting results to files or output streams.

PowerShell Get-ADComputer Cmdlet Used for Computer Discovery and File Export

Flags PowerShell Get-ADComputer wildcard enumeration followed by writing exported computer data to a file.

PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).