Sigma detection rules, expert-reviewed

Windows Security: Detect Obfuscated PowerShell IEX Invocation via ServiceFileName Patterns (Event ID 4697)

Alerts on EventID 4697 instances where ServiceFileName matches obfuscated IEX-style PowerShell invocation patterns consistent with Invoke-Obfuscation.

Windows PowerShell: Silence EmpireDNSAgent script matches DNS tunnel and remote shutdown/restart activity

Flags PowerShell ScriptBlockText that combines Empire process-control indicators with dnscat DNS tunneling commands.

Windows PowerShell Script Execution from Alternate Data Stream (ADS)

Flags PowerShell processes using Get-Content -Stream to execute or retrieve script content from an ADS.

Windows PowerShell Audio Capture Cmdlets: Toggle/Get/Set/Write AudioDevice

Flags PowerShell command lines referencing audio device cmdlets used to get/toggle/set/write audio device settings.

Windows PowerShell ScriptBlock Web Request Cmdlets and Command-Line Tools

Alerts when PowerShell script blocks reference web request and download cmdlets/commands, excluding a specific guest configuration path.

Windows PowerShell Profile File Creation or Modification

Alerts on creation or modification of PowerShell profile.ps1 files in typical Windows and PowerShell 7 locations.

Windows Shadow Copy Deletion via PowerShell, WMIC, vssadmin, diskshadow, or wbadmin

Flags Windows commands that use shadow-copy management utilities with deletion or shadowstorage removal parameters.

Windows Shadow Copy Creation via PowerShell/pwsh/wmic/vssadmin Commands

Detects Windows processes using PowerShell/pwsh/wmic/vssadmin with shadow copy creation parameters.

PowerShell ScriptBlock Winlogon Registry Modification via CurrentVersion\Winlogon

Detects PowerShell script blocks that modify Winlogon helper registry keys via Set-ItemProperty or New-Item on Windows.

PowerShell Compress-Archive Cmdlet Execution for Data Compression

Flags PowerShell scripts using the Compress-Archive cmdlet, consistent with local data packaging before collection or exfiltration.

PowerShell ScriptBlock uses rundll32 with shell32.dll and obfuscated invoke/comspec/iex

Flags PowerShell script blocks containing rundll32/shell32.dll execution strings alongside invoke/iex/comspec patterns.

PowerShell module: Obfuscated Invoke via rundll32/shell32.dll comspec iex patterns

Flags PowerShell module payloads containing obfuscated rundll32 shell32.dll shellexec_rundll invocation patterns.

Windows Process Activity Clearing or Modifying Event Logs via Wevtutil, PowerShell, or WMI

Flags suspicious Windows process command lines that clear or reconfigure Event Logs using wevtutil, PowerShell, or WMI, with an msiexec exception.

Windows remote PowerShell session activity via wsmprovhost.exe process relationships

Alerts when wsmprovhost.exe is seen as a process or parent process, indicating remote PowerShell via WinRM.

Windows: Non-interactive PowerShell (powershell.exe/pwsh.exe) spawned from GUI or updater parents

Alerts on non-interactive PowerShell spawned by atypical parent processes, excluding known update, VS Code, terminal, and defender-related parents.