Sigma detection rules, expert-reviewed

PowerShell Adds Windows Defender Exclusions via Add-MpPreference/Set-MpPreference

Flags PowerShell commands that add Windows Defender exclusions using Add-MpPreference/Set-MpPreference with exclusion parameters.

Windows PowerShell Sensitive File Discovery via Script Block Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.

Windows PowerShell Disables Windows Firewall Profiles via Set-NetFirewallProfile

Flags PowerShell commands attempting to turn off Windows Firewall profiles using Set-NetFirewallProfile.

PowerShell Script Block Logging: Suspicious Windows Event Log Clearing Cmdlets

Flags PowerShell script blocks that call event log clearing cmdlets or ClearLog to impair Windows log visibility.

PowerShell Enable-WindowsOptionalFeature Enables Suspicious Windows Optional Features (Windows)

Alerts on PowerShell enabling Windows optional features online for specific, potentially risky feature names.

PowerShell Disable-WindowsOptionalFeature -Online -FeatureName for Windows Defender features

Detects PowerShell disabling online Windows Defender features via Disable-WindowsOptionalFeature -FeatureName.

PowerShell User Discovery and Export with Get-ADUser

Flags PowerShell Get-ADUser enumeration (filter *) followed by exporting results to a file.

Windows Root Certificate Installation from Suspicious Paths via PowerShell Import-Certificate

Alerts on PowerShell importing a root certificate into Cert:\LocalMachine\Root from suspicious file paths on Windows.

PowerShell Email Address Exfiltration via EXIF-style Recipient Harvesting on Windows

Alerts when PowerShell command lines enumerate Exchange recipients and expand email address properties, indicating potential email data exfiltration.

Windows PowerShell Download Cradle Using nslookup TXT Queries (Process Creation)

Flags PowerShell spawning nslookup configured to query DNS TXT records as a download cradle.

Windows Service Control Binary Usage: Stop/Pause/Disable/Delete on Protected Services

Alerts on net/sc/wmic/PowerShell commands that stop, pause, delete, or disable Windows services, especially security/backup services.

Windows Process Execution: Suspicious PowerShell Encoded Command with Exec Bypass

Flags Windows process creations with a bypass-and-encoded PowerShell Start-Job command-line pattern linked to Mercury-related activity.

Windows process command line matching Sliver C2 implant NoExit PowerShell UTF8 pattern

Alerts on Windows process command lines matching a Sliver-style PowerShell -NoExit encoding pattern.

Windows File Changes to Microsoft.VSCode_profile.ps1 via PowerShell Profile

Detects creation or modification of Microsoft.VSCode_profile.ps1 based on Windows file events.

Windows PowerShell Command History Disable via Remove-Module psreadline

Detects PowerShell scripts that remove psreadline with Remove-Module to suppress command history evidence.