Every published rule

Windows Firewall Settings Change Events (Windows Firewall/Defender Firewall-AS)

Alert on Windows Firewall/Defender firewall setting changes using Events 2002, 2003, 2008, 2082, and 2083.

Windows Defender Firewall Reset to Default Configuration (Firewall-as Service)

Flags Windows where Windows Defender Firewall is reset to default settings via firewall-as events.

Windows Defender Firewall Service Failed to Load Group Policy (Event ID 2009)

Alert on Event ID 2009 when the Windows Defender Firewall service cannot load Group Policy.

Windows Firewall Exception List Rule Modified (Firewall-as Events 2005/2073)

Flags Windows Defender Firewall exception list changes (Event IDs 2005/2073), indicating potential attacker-driven network access changes.

Windows: attrib.exe Executed with +s to Mark Files as System Files

Flags attrib.exe executions that include the +s switch to mark target files as system files.

PowerShell Mount-DiskImage with -ImagePath to Access Disk Images

Alerts on PowerShell script blocks calling Mount-DiskImage with -ImagePath, indicative of disk-image-based payload staging.

Windows Installer Application Removed via MsiInstaller Events

Alerts on Windows Installer events indicating an application was removed via MsiInstaller.

Windows PowerShell: Suspicious SslStream Client Certificate Validation in Script Block

Flags PowerShell scripts referencing SslStream and client-side certificate validation during SSL client authentication.

Windows Office Macro File Creation from Browser or Email Client

Flags Windows creation of macro-enabled Office files (.docm/.xlsm/.pptm) initiated by common browsers or email clients.

Windows Office Macro File Creation via Office Applications

Alerts on creation of macro-enabled Office documents/templates by Office apps on Windows, excluding Office temporary files.

Windows Registry: Internet Settings Zone and Cache-related Key Modifications

Flags registry writes to Windows Internet Settings-related keys that can be abused to alter zone trust or store persistence data.

Windows Code Integrity: Unmet Signing Level Requirements When Loading a File (Event ID 3033/3034)

Alerts on Code Integrity file-load attempts failing signing level requirements, based on Event ID 3033/3034 in Windows Code Integrity logs.

Linux doas Command Execution Identified

Flags Linux executions of the doas utility based on process image path ending with /doas.

Windows: Deletion of TeamViewer log files

Alerts on deletion of TeamViewer *.log files on Windows, excluding deletions performed by svchost.exe.

Windows msiexec.exe Initiates Outbound HTTP(S) Connection on Port 80/443

Alerts when msiexec.exe starts outbound connections to ports 80 or 443, indicating potential remote package retrieval.

Windows rmdir Directory Removal via cmd.exe Execution

Monitors cmd.exe process creation where rmdir is used with /s and/or /q to delete directories and reduce forensic artifacts.

Windows del/erase Command-Line File Deletion via cmd.exe

Flags cmd.exe executions running del/erase for file removal, including common flags like /f, /s, and /q.

Windows PowerShell ScriptBlock Use of Remove-Item to Delete Files or Folders

Alerts on PowerShell ScriptBlockText containing Remove-Item/del/rm/rd-style -Path deletion commands.

Windows Dynamic C# Compilation Generates .cmdline Artifact

Detects Windows file events where dynamic C# compilation produces a .cmdline artefact.

PowerShell script exfiltration using Invoke-WebRequest with POST or PUT

PowerShell scripts referencing Invoke-WebRequest with -Method POST/PUT indicate potential data upload behavior.