Every published rule

Windows Process Creation: Explorer Command Lines with Unicode Whitespace Padding and '#'

Alerts when Explorer spawns a process with command lines containing long Unicode whitespace padding followed by '#'.

Windows Application Logs: Detect WSUS deserialization exploitation via InvalidCastException indicators

Flags WSUS (EventID 7053) application log errors matching invalid cast/object data provider strings indicative of CVE-2025-59287 exploitation.

Windows Process Creation: Suspicious cmd.exe or PowerShell Child of WSUS (wsusservice.exe)

Alerts when WSUS/IIS service processes spawn cmd or PowerShell interpreters, indicating potential exploitation and post-exploitation activity.

Windows SpeechRuntime.exe Child Process Creation

Alerts when SpeechRuntime.exe spawns a child process, highlighting potential abuse for lateral movement on Windows.

Windows Winrs.exe Local Command Execution via localhost/loopback

Alerts on Winrs.exe processes running locally by targeting localhost/loopback in /r or /remote.

Windows Process Creation: Commvault qlogin Argument Injection Indicators for Auth Bypass

Alerts on Windows command lines running Commvault qlogin with -localadmin-related markers consistent with argument injection.

Windows Process: Commvault qoperation.exe JSP Webroot Path Traversal Webshell Drop

Alerts on qoperation.exe commands that use -file to write a .jsp into a webroot path, consistent with a webshell drop.

AWS CloudTrail Detects EC2 DeleteFlowLogs API Calls

Flags successful EC2 DeleteFlowLogs API calls in CloudTrail indicating VPC Flow Logs were removed.

Windows: Detect baaupdate.exe Spawning Scripting, Admin, or LOLBin Child Processes

Alerts when baaupdate.exe runs typical script/utility processes, an uncommon parent-child execution pattern on Windows.

Windows: Detect Suspicious DLL Loads by BaaUpdate.exe from Publicly Writable Paths

Alerts when BaaUpdate.exe loads DLLs from Temp/Public-type locations associated with DLL search hijacking risk.

Kaspersky Endpoint Security Service Stopped via Command Line on Linux

Flags Linux commands using systemctl/bash/sh to stop Kaspersky (kesl) services, suggesting defense impairment or manual service shutdown.

AWS KMS Imported Key Material Import or Deletion via CloudTrail

Detects AWS KMS imported key material events in CloudTrail, including import and deletion of imported key material.

Windows Process Execution: Restic Backup Tool Command-Line Indicators

Flags Windows executions where Restic is run with repo init/backup flags or remote storage targets.

Linux systemctl Mask Power Targets to Disable Suspend, Hibernate, Hybrid Sleep

Flags systemctl mask commands targeting suspend/hibernate/hybrid-sleep power management targets.

Linux auditctl -D used to delete all audit rules

Flags auditctl -D executions that delete all audit rules and watchers on Linux.

WSL Process Execution of Kali Linux on Windows

Flags Kali Linux running under WSL on Windows using process creation image and command-line indicators.

Windows WSL Kali Linux installation via wsl.exe --install -i

Flags wsl.exe commands that install a distribution specified as Kali Linux using --install -i.

Windows Process Creation: GoAnywhere child command execution indicating possible MFT exploitation

Flags Windows process trees where GoAnywhere Tomcat spawns suspicious cmd/PowerShell command lines consistent with exploitation activity.

Linux File Creation of /etc/nsswitch.conf in Non-Standard Paths

Flags creation of /etc/nsswitch.conf in non-standard locations that could support privilege escalation.

Windows Registry RunMRU Key Deletion

Alerts on deletion of the Windows Run dialog command history (RunMRU) registry key.