Every published rule

Windows Process Execution for PowerShell Cobalt Strike Download via Hidden IEX

Flags PowerShell command lines that use IEX and hidden downloadstring to fetch a Cobalt Strike payload.

Windows PowerShell script launcher matching SysAidServer Tomcat paths

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

PowerShell Script Evidence Eraser Searching for cleanLL and usersfiles.war

Identifies PowerShell script blocks containing evidence-cleanup indicators and a repeating while(1) loop.

Windows PowerShell Script File Creation: SysAidServer Webapp User/User.exe Indicators

Detects creation of specific SysAidServer Tomcat webapp files indicative of PowerShell script staging on Windows.

Windows: VS Code Tunnel Launching PowerShell or WSL/Bash Shell

Flags VS Code tunnel (node.exe) spawning PowerShell, WSL, or bash shell processes on Windows.

Windows PowerShell EnableScripts Policy Enabled via Registry DWORD

Flags registry changes that enable PowerShell script execution via the EnableScripts policy (DWORD 0x00000001).

Suspicious Child Process Spawned by Diskshadow.exe (Windows Process Creation)

Alerts on process creation where Diskshadow.exe spawns certutil, cscript, mshta, PowerShell, regsvr32, rundll32, or wscript.

Suspicious LOLBIN Copy From Windows System Directories Using Windows Copy Tools

Flags cmd/PowerShell/robocopy/xcopy commands that copy known LOLBINs out of System32/SysWOW64/WinSxS.

Windows Fake wermgr.exe Execution via Renamed cmd/powershell/powershell_ise

Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.

Windows Process Execution Triggered from WebDAV LNK Paths

Alerts on explorer.exe launching cmd/cscript/mshta/powershell/wscript/pwsh when the command line references a WebDAV \DavWWWRoot\ LNK path.

Suspicious Child Process Creation from BgInfo.EXE on Windows

Alerts when BgInfo.exe spawns suspicious calc/cmd/cscript/mshta/powershell/wscript or runs from common AppData/Temp paths.

Windows PowerShell ScriptBlock WinAPI Function Calls

Find PowerShell script blocks that reference WinAPI/native-call function names tied to process, memory, token, or thread operations.

PowerShell Scripts Calling WinAPI DLLs on Windows

Detects PowerShell script blocks that reference WinAPI-related Windows DLLs such as kernel32.dll and ntdll.dll.

PowerShell Script Block: SMB QUIC Share Mapping via New-SmbMapping

Alerts when PowerShell maps Windows SMB shares using New-SmbMapping with -TransportType QUIC.

Windows Process Creation: schtasks.exe Creating Scheduled Task Launching Registry-Stored PowerShell Payload

Flags schtasks.exe /Create scheduled tasks that launch PowerShell decoding and executing a base64 payload retrieved from Windows Registry.

Windows PowerShell Script Modifies File Permissions with Set-Acl

Flags PowerShell scripts that call Set-Acl to change ACL permissions on a specified path.

Windows PowerShell WMI Win32_NTEventlogFile Calls with Event Log Tampering Methods

Flags PowerShell calling Win32_NTEventlogFile WMI methods commonly used to clear, delete, backup, or alter Windows event logs.

Suspicious PowerShell WMI Win32_NTEventlogFile Usage (Event Log Tampering)

Detects PowerShell scripts calling Win32_NTEventlogFile methods associated with event log deletion, backup, renaming, or permission changes.

PowerShell NetFirewallRule Cmdlet Enumeration of Local Windows Firewall Rules

Flags PowerShell attempts to enumerate local Windows firewall rules via Get-NetFirewallRule or Show-NetFirewallRule.

Windows PowerShell Script Accessing Windows MailApp MailBox Data Path

Identifies PowerShell scripts referencing the Windows MailApp mailbox data path, which may indicate email data access or manipulation.