Sigma detection rules, expert-reviewed

Windows: Code execution via Pester.bat invoked by PowerShell (Invoke-Pester/Get-Help)

Alerts when PowerShell spawns Pester.bat with parent command lines referencing Pester invocation or help usage.

Windows PowerShell: GPO ScriptBlock Modifying Group Policy and SmartScreen Settings

Alerts on PowerShell ScriptBlock content referencing Group Policy policy keys and specific security policy value names.

PowerShell Write-EventLog with -RawData Flag

Alerts when PowerShell script blocks call Write-EventLog using the -RawData flag.

Windows PowerShell ScriptBlock: Remove-MpPreference Tampering of Defender Configuration

Detects PowerShell commands removing Defender preferences via Remove-MpPreference with additional Defender setting indicators.

Windows Suspicious IIS Module Registration via w3wp.exe, appcmd.exe, and PowerShell/gacutil

Flags w3wp.exe-launched appcmd.exe module registrations involving PowerShell publication or gacutil GAC installation.

Windows Command-Line Tools Performing Web POST Exfiltration via IWR/curl/wget

Identifies PowerShell/curl/wget commands on Windows that use POST-style web requests combined with data-dumping or discovery payloads.

Windows PowerShell Invoke-WebRequest Download to Suspicious Paths

Alert when PowerShell uses Invoke-WebRequest/aliases with download flags and targets suspicious file locations.

Windows Suspicious Service Creation via sc.exe or PowerShell New-Service with Abnormal Binary Paths

Flags service creation commands (sc.exe/New-Service) when the specified binary path includes suspicious directories or script/loader utilities.

Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns

Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.

PowerShell TCP Tunnel Indicators: HttpWebRequest and TcpListener Usage (Windows

Flags PowerShell scripts referencing TcpListener/AcceptTcpClient and HttpWebRequest as potential TCP tunneling behavior.

Windows PowerShell: Import-Module From Temp, AppData, or Public Directories

Detects PowerShell module imports (Import-Module/ipmo) from Temp, AppData, or Public directories via Script Block Logging.

PowerShell Disable or Remove ETW Trace Sessions

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

Windows PowerShell: Execution of TroubleshootingPack Cmdlets (msdt-related usage)

Flags PowerShell script blocks invoking TroubleshootingPack with unattended answer-file arguments.

Windows PowerShell Hotfix Enumeration via Win32_QuickFixEngineering

Detects PowerShell scripts enumerating installed hotfixes by querying Win32_QuickFixEngineering for HotFixID.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.