Sigma detection rules, expert-reviewed

Windows PowerShell CommandLine downloads and executes via WebClient with IEX or DownloadFile

Alerts on PowerShell command lines that use WebClient downloads combined with IEX or DownloadFile, typical of staged payload execution.

Windows: ScreenConnect Client Service Spawning Suspicious Utility Commands

Alerts when ScreenConnect run.cmd leads to child processes like cmd.exe, PowerShell, curl, or other utilities.

Windows Process Creation: Hermetic Wiper–style Postgres/PowerShell Command-Line Patterns

Flags Windows process creation with wiper-like PowerShell comsvcs MiniDump and related command-line/paths.

Suspicious Reset-ComputerMachinePassword Usage via PowerShell on Windows

Detects PowerShell executions of Reset-ComputerMachinePassword that may indicate attempts to alter domain computer account authentication.

Windows schtasks Creates Registry-Backed Base64 PowerShell Payload via Encoded Command

Flags schtasks.exe scheduling that triggers PowerShell to decode a base64 payload pulled from Windows Registry.

PowerShell DirectorySearcher AD Computer Enumeration via System.DirectoryServices.DirectorySearcher

Flags PowerShell DirectorySearcher queries that load directory properties and enumerate results from Active Directory.

Windows Process Execution: ZeroLogon PoC Tool (cool.exe/zero.exe) via cmd.exe

Alerts on cmd.exe launching cool.exe/zero.exe with ZeroLogon PoC-style arguments and follow-on taskkill or PowerShell activity.

Windows process creation: flag suspicious program names and PowerShell script indicators

Alerts on suspicious Windows process image names and PowerShell command-line script/tool patterns commonly used in malicious tooling.

Windows Process Creation: cmd.exe Launching with PowerShell in .lnk Link Command

Alerts when explorer launches cmd.exe with command lines containing both PowerShell and a .lnk reference.

Windows PowerShell: DSInternals Get-ADReplAccount Enumeration

Alerts on PowerShell execution of Get-ADReplAccount with -All and -Server parameters for AD replication account enumeration.

Windows PowerShell: Suspicious Unblock-File to Remove Zone.Identifier

Flags PowerShell use of Unblock-File (-Path) that can remove Zone.Identifier downloaded-file metadata.

PowerShell Mount-DiskImage with -ImagePath to Access Disk Images

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

Windows PowerShell: Suspicious Invoke-Item After Mount-DiskImage

Flags PowerShell that mounts an image, derives a drive letter, then runs content via invoke-item from that mount.

Windows PowerShell ScriptBlock Accessing Browser 'Login Data' Files

Flags PowerShell Copy-Item operations targeting browser Login Data credential database paths on Windows.

Windows PowerShell Scripts Testing Uncommon Port Connectivity via Test-NetConnection

Detects PowerShell scripts using Test-NetConnection to reach a target on non-443/80 ports.