Sigma detection rules, expert-reviewed

Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Identifies command-line attempts to clear/disable ETW traces or remove/modify ETW providers on Windows.

Windows: PowerShell-triggered HTA retrieval and execution with registry and process disruption

Alerts on Windows process creation where PowerShell uses mshta over HTTP and includes .hta, registry query, and cmd.exe termination.

Windows: Alert on suspicious parent process spawning csc.exe

Flags csc.exe execution when spawned by script/document hosts or PowerShell using encoded content, excluding common benign parent contexts.

Windows PowerShell Script Block Matches Common Reflection and Injection Keywords

Alerts on PowerShell script block text containing reflection, dynamic assembly loading, and injection-related keywords.

Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

PowerShell Spawned by wscript.exe or cscript.exe on Windows

Flags PowerShell launched by Windows script engines (wscript/cscript), excluding specific Health Service State activity.

Windows PowerShell execution with download-related command line patterns

Alerts when PowerShell is started with command-line fragments indicative of downloading remote content.

Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

Alerts on PowerShell launching with 'hidden' and embedded base64-like strings in the command line.

PowerShell Executed From AppData on Windows (Command Line Indicators)

Flags PowerShell command lines that include AppData paths (Local/Roaming), indicating possible user-profile script execution.

Windows PowerShell Base64-encoded shellcode in ScriptBlockText

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Flags PowerShell (powershell.exe/pwsh) process executions with command-line indicators consistent with XOR/obfuscated scripting.

Windows PowerShell Suspicious Encoded Command-Line Execution

Alerts on PowerShell launched with encoded-command switches and embedded encoded content patterns in the command line.

Windows Process Creation: PowerShell Command Execution Hidden in DLL Invocation

Flags DLL-invoking Windows binaries whose command lines include PowerShell execution strings.

PowerShell NTFS Alternate Data Stream Writes via set-content/add-content

Alerts on PowerShell Set/Add-Content operations that specify -Stream, indicating potential NTFS Alternate Data Stream writes.

Windows PowerShell Remote Thread Creation Into Uncommon Target Processes

Alerts on PowerShell creating remote threads in rundll32.exe or regsvr32.exe on Windows.