Every published rule

Windows Service Control Manager Rundll32 Obfuscation via Command-Line Encoded PowerShell

Detects service creation where ImagePath invokes rundll32 (shell32) with command-chain tokens indicative of obfuscated PowerShell.

Windows System: mshta Launches vbscript:createobject via Service Control Manager (Event ID 7045)

Flags Windows service creation (7045) where ImagePath includes mshta and vbscript:createobject.

Windows System: Suspicious Clip.exe Execution via Service Control Manager (Event ID 7045)

Alerts on Windows service creation starting clipboard/Clip.exe-related binaries via Service Control Manager ImagePath.

Windows Security 4697: Obfuscated command uses rundll32 with shell32.dll

Alerts on EventID 4697 service command lines containing rundll32 with shell32.dll/shellexec_rundll and obfuscation-like script fragments.

Windows Security EID 4697: mshta Used to Run Obfuscated VBScript PowerShell

Detects service creation where the binary path includes mshta plus VBS/automation indicators consistent with script-based obfuscation.

Windows Security 4697: Obfuscated PowerShell via use of Clip.exe from scripts

Alerts on EID 4697 service installations where the service file name matches Clip/clipboard indicators tied to obfuscated PowerShell.

Windows Process Execution: Obfuscated PowerShell Invocation Using mshta with VBScript CreateObject

Flags Windows process command lines containing an obfuscated PowerShell+MSHTA VBScript execution pattern.

PowerShell ScriptBlock Obfuscation via MSHTA VBScript CreateObject Execution

Alerts on PowerShell script blocks containing mshta and VBScript createobject/.run/window.close patterns consistent with obfuscated execution.

PowerShell Module: Obfuscated MSHTA Invocation via VBS CreateObject

Alerts when PowerShell module payload text includes an obfuscated MSHTA/VBScript invocation sequence.

UAC Bypass Using wsreset.exe Registry Command Path (Windows)

Identifies registry TargetObject values associated with a wsreset-style UAC bypass execution command path on Windows.

Windows Visual Basic vbc.exe Compiles to .obj via cvtres.exe Resource Converter

Alerts when vbc.exe spawns cvtres.exe during Windows VB command-line compilation activity.

Windows regedit.exe exports a registry key into an alternate data stream

Flags regedit.exe executions where the process image ends with '\regedit.exe', consistent with exporting Registry data to an alternate data stream.

PowerShell Service Persistence via Registry ImagePath on Windows

Flags Windows registry service ImagePath entries that reference PowerShell (powershell/pwsh).

Windows: Time Travel Debugging Utility (tttracer.exe) Process Execution

Alerts when tttracer.exe is the parent process of a spawned process on Windows.

PowerShell Script Block WinAPI Calls Indicative of Injection or Token Abuse (Windows)

Detects PowerShell ScriptBlocks containing WinAPI function-name combinations consistent with injection and token manipulation.

Windows UAC Bypass via dism.exe Loading Fake dismcore.dll

Alerts when dism.exe loads a dismcore.dll that is not the expected System32 Dism DLL.

Windows Time Travel Debugging DLL Loads (ttdrecord/ttdwriter/ttdloader)

Flags Windows image loads of Time Travel Debugging Utility DLLs (tdrecord/tdwriter/tdloader), often abused for stealthy credential dumping.

Windows PowerShell Remote Thread Into lsass.exe Suggesting Credential Dumping

Alerts when PowerShell creates a remote thread into lsass.exe, indicating possible credential dumping on Windows.

PowerShell Script Execution via Windows Service Creation (Service Control Manager)

Flags service creation/start events where the service ImagePath references PowerShell (powershell/pwsh).

Windows Service Creation of PowerShell/Pwsh Scripts (Security EID 4697)

Alerts on service creation events where the service executable name includes powershell or pwsh.