Sigma detection rules, expert-reviewed

Windows PowerShell: WebRequest User-Agent Modification in ScriptBlockText

Detects PowerShell scripts that make web requests and set a custom -UserAgent value.

Windows PowerShell XML Document Load Used for Execution

Flags PowerShell script blocks that use XML document loading combined with expression/command execution keywords.

PowerShell MsXml2.XmlHttp COM Object Instantiation

Alerts on PowerShell creating an MsXml2.XmlHttp COM object through New-Object -ComObject.

PowerShell ScriptBlock Logging: Set-MpPreference disables Windows Defender scanning or allows threats

Alert on PowerShell Set-MpPreference usage that disables Defender scanning/monitoring or sets threat default actions to Allow.

Windows PowerShell: Start-Process with -PassThru and -FilePath

Alerts on PowerShell Start-Process calls that include -PassThru and -FilePath, based on ScriptBlockText matches.

Windows PowerShell ScriptBlock Use of Remove-Item to Delete Files or Folders

Alerts on PowerShell ScriptBlockText containing Remove-Item/del/rm/rd-style -Path deletion commands.

Windows Process Creation: VMware Horizon Log4j RCE Attempt via ws_TomcatService to cmd/powershell

Alert on ws_TomcatService.exe spawning cmd.exe or PowerShell on Windows as suspicious exploitation activity.

PowerShell Script Creates Volume Shadow Copy via Win32_ShadowCopy

Alerts when PowerShell script blocks invoke Win32_ShadowCopy.Create to create a ClientAccessible shadow copy.

Windows ChromeLoader Execution via Scheduled Task and Hidden PowerShell Launch

Flags PowerShell-launched chrome.exe that uses --load-extension from local AppData Chrome paths for ChromeLoader-style execution.

PowerShell script exfiltration using Invoke-WebRequest with POST or PUT

PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.

PowerShell DNSExfiltrator command usage (DNSExfiltration)

Detects PowerShell use of Invoke-DNSExfiltrator for DNS/DoH-based exfiltration based on Script Block Logging content.

Windows PowerShell: Invoke-Command targeting -ComputerName via script block

Detects PowerShell Invoke-Command targeting remote hosts by matching script block text with -ComputerName.

Windows PowerShell script enabling WinRM via Enable-PSRemoting

Alerts on PowerShell scripts that include Enable-PSRemoting, a common step to activate WinRM for remote access.

Windows PowerShell Remote Session Creation via New-PSSession

Flags PowerShell usage of New-PSSession with a ComputerName in script block logging, indicating remote session creation.

Suspicious PowerShell Execution with Base64 Encoded Command (Windows)

Alerts on PowerShell launched with Base64-encoded command-line parameters, excluding likely Guest Configuration noise.