Sigma detection rules, expert-reviewed

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.

Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

Flags PowerShell executions on Windows when the CommandLine is 1000+ characters long.

PowerShell Access to LSASS on Windows Suggesting Credential Dumping

Alerts when PowerShell (powershell.exe/pwsh.exe) accesses lsass.exe, indicating potential credential dumping.

PowerShell Remote Thread Creation (Windows CreateRemoteThread)

Alerts when PowerShell creates a remote thread in another process, excluding CompatTelRunner.exe activity.

Non-privileged reg.exe or PowerShell registry service configuration changes on Windows

Flags non-admin reg.exe or PowerShell activity targeting service registry configuration paths on Windows.

Windows: SyncAppvPublishingServer.exe execution via PowerShell script block content

Flags PowerShell script blocks that reference SyncAppvPublishingServer.exe, indicating possible execution via a PowerShell-restricted workflow.

Windows SyncAppvPublishingServer Execution Triggering PowerShell Module Context

Alerts when SyncAppvPublishingServer.exe appears in PowerShell module ContextInfo on Windows.

Windows Security: Suspicious Remote Logon Using Explicit Credentials via Command-Line Tools

Flags EventID 4648 remote logons initiated by cmd/PowerShell/winrs/wmic/net/reg-style processes using explicit credentials.

Windows Process Proxying: explorer.exe Spawned from cmd.exe or PowerShell

Flags cmd.exe/powershell.exe launching explorer.exe, indicating possible proxy-based execution on Windows.

Windows PowerShell Command Lines Containing [char]0x or (WCHAR)0x Obfuscation Syntax

Identifies PowerShell execution command lines using suspicious [char]0x or (WCHAR)0x encoding patterns.

Windows Process Execution: Copy From System Directories to Other Locations

Detects cmd.exe, PowerShell, and copy utilities copying files from System32/SysWOW64/WinSxS to other locations on disk.

PowerShell Classic bXOR Operator Usage in Command Line

Identifies PowerShell classic executions from ConsoleHost using the -bxor operator in the command line.

Suspicious WSMAN COM Provider Usage Without PowerShell Host (Windows)

Alerts on WSMAN COM provider activity where the host application is not PowerShell.exe in PowerShell Classic logs.

Windows Process Creation: Detect Covenant PowerShell Launcher Command Lines

Identifies Windows PowerShell command lines commonly used by Covenant launchers, including hidden/encoded execution patterns.

Windows: CrackMapExec PowerShell obfuscation via join/split static patterns

Flags Windows PowerShell executions with command-line obfuscation strings associated with CrackMapExec behavior.