Every published rule

PowerShell Get-ADComputer Export of Active Directory Computer Data to File (Windows)

Detects PowerShell running Get-ADComputer (* filter) and exporting results to a file via output/content cmdlets.

PowerShell AMSI Bypass Assembly GetType Pattern in Script Block Text

Flags PowerShell scripts containing a reflection-based AMSI bypass fragment with GetType and SetValue($null,$true).

Windows process creation: suspicious ping wait followed by del file deletion

Flags cmd/powershell command lines that use ping -n with Nul redirection followed by Del /f /q to delete a file.

Windows Exchange PowerShell Cmdlet History Log Files Deleted

Flags deletion of Exchange PowerShell cmdlet history log files in the expected logging directory.

PowerShell: Suspicious Set-Service DACL/SecurityDescriptor Modification for Hidden Services

Flags PowerShell ScriptBlock activity using Set-Service with specific SDDL elements consistent with hiding services from tools like sc.exe.

PowerShell Set-Acl targeting Windows folder paths on Windows

Flags PowerShell Set-Acl commands that modify ACLs for Windows folder paths, often using FullControl/Allow.

PowerShell Set-Acl Script Execution Changes File or Folder Permissions on Windows

Flags PowerShell commands using Set-Acl (-AclObject and -Path) to alter Windows file or folder permissions.

PowerShell Set-Service SecurityDescriptorSddl DACL Modification for Windows Services

Detects PowerShell Set-Service commands with SecurityDescriptorSddl SDDL patterns that modify Windows service DACLs.

Windows PowerShell Set-Service SDDL Usage to Hide Services

Flags pwsh Set-Service commands that set a SecurityDescriptorSddl to hide a Windows service from other tools.

PowerShell Set-Service SecurityDescriptor (DCLCWPDTSD) to Hide Services

Flags PowerShell Set-Service calls that set a SecurityDescriptor SDDL (DCLCWPDTSD) to hide services from other utilities.

Windows PowerShell Recon Using Get-LocalGroupMember on Local/Well-Known Groups

Flags PowerShell Get-LocalGroupMember usage targeting notable local group names in process creation logs.

Windows Process Creation: SharpWSUS or WSUSpendu Execution via PowerShell Parameters

Detects command-line execution patterns for SharpWSUS or WSUSpendu on Windows.

PowerShell PSAsyncShell Reverse Shell Activity via Script Block Logging

Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.

PowerShell ScriptBlock Matching Invoke-Mimikatz Credential Dump Commands (Windows)

Detects PowerShell ScriptBlocks containing Mimikatz-like credential dump and certificate extraction command strings.

PowerShell Script Exfiltration Attempt: Send-MailMessage with Attachments

Detects PowerShell Send-MailMessage usage with -Attachments, which may indicate SMTP-based data exfiltration.

Windows PowerShell WMI Volume Shadow Copy Deletion

Flags PowerShell WMI/CIM commands that query Win32_ShadowCopy and attempt deletion.

PowerShell WMI Script Deletes Windows Volume Shadow Copies

Flags PowerShell WMI/CIM scripts that enumerate Win32_ShadowCopy and attempt to delete it.

PowerShell Adds Windows Defender Exclusions via Add-MpPreference/Set-MpPreference

Flags PowerShell commands that add Windows Defender exclusions using Add-MpPreference/Set-MpPreference with exclusion parameters.

Windows PowerShell Sensitive File Discovery via ScriptBlock Enumeration

PowerShell script blocks using recursive file enumeration that target sensitive file extensions.

Windows PowerShell Disables Windows Firewall Profiles via Set-NetFirewallProfile

Flags PowerShell commands attempting to turn off Windows Firewall profiles using Set-NetFirewallProfile.