Every published rule

Windows: Detect suspicious PowerShell/Lsass tool execution launched by ManageEngine (ServiceDesk)

Alerts on suspicious child PowerShell/LSASS/tool activity launched by ManageEngine ServiceDesk (Java parent) on Windows.

Windows Process Creation: AsperaFaspex Parent Spawning PowerShell or Credential-Access Tooling

Detects AsperaFaspex (aspera\ruby parent) spawning suspicious PowerShell, LSASS, web download, privilege, or defensive-evasion commands on Windows.

Windows: Detect Action1 agent deployment, command execution, and remote session startup

Finds Action1 agent deployments, script-launched command/PowerShell execution, and remote session starts on Windows.

Windows PowerShell File Dropper Activity: Creating Executables or Script Files

Alerts when PowerShell writes .exe/.dll or script-like files, consistent with binary/script staging or dropping.

Windows PowerShell Downloading DLLs via Invoke-WebRequest or Invoke-RestMethod

Alerts on PowerShell using web request cmdlets to download an HTTP DLL to disk.

PowerShell GzipStream Decompression Attempts on Windows

Detects Windows PowerShell commands using GZipStream and ::Decompress to decompress encoded Gzip data.

Windows Process Creation: mshta/VBScript Launching PowerShell and Embedded Backdoor Logic

Alerts on Windows command lines combining mshta VBScript execution bypass, system survey WMI queries, and PowerShell HTTP/Base64 patterns.

Windows PowerShell Execution with Encoded Hidden Execution Flags (Wmiexec)

Flags PowerShell process launches containing the Wmiexec default hidden/no-profile/execution-bypass flag sequence.

Windows PowerShell Stop-Service Used to Stop a Service

Flags PowerShell executions that include the Stop-Service cmdlet to stop a Windows service.

Windows PowerShell Set-Service StartupType Change to Disabled or Manual

Alerts on PowerShell Set-Service commands changing a service startup type to Disabled or Manual on Windows.

PowerShell Creates Windows Service via New-Service and -BinaryPathName

Flags PowerShell command lines that use New-Service with -BinaryPathName to create a Windows service.

Windows PowerShell Console History File Deleted (PSReadLine)

Flags deletion of the PowerShell PSReadLine ConsoleHost_history.txt file, which can remove command history evidence.

Windows Process Execution of Script Interpreters After Extraction from Compressed Files

Flags parent 7zip/WinRAR/Explorer temp extraction leading to execution of script interpreters such as PowerShell or HTA.

Windows OneNote.exe launches cmd/cscript/mshta/PowerShell/wscript with OneNote-exported scripts

Alerts when OneNote.exe spawns common script interpreters to execute OneNote-exported or offline-cache script content.

Windows: PowerShell Add-AppxPackage Attempt With -AllowUnsigned for AppX Installation

Detects PowerShell Add-AppxPackage usage with -AllowUnsigned to install unsigned AppX packages.

Windows PowerShell: Add-AppxPackage with -AllowUnsigned for Unsigned AppX Installation

Flags PowerShell usage of Add-AppxPackage/Add-AppPackage with -AllowUnsigned to install unsigned AppX packages.

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.

Windows PowerShell Module Execution Matches Known Offensive PoshModule Script Names

Alerts on Windows PowerShell module executions where the script context matches known offensive PowerShell script/module names.

PowerShell on Windows adding Windows capabilities via Add-WindowsCapability

Alerts when PowerShell adds an OpenSSH-related Windows capability using Add-WindowsCapability.

Windows PowerShell imports Microsoft.ActiveDirectory.Management.dll via Import-Module (AD enumeration)

Alerts when PowerShell imports Microsoft.ActiveDirectory.Management.dll using Import-Module, indicating potential AD enumeration.