Alternate PowerShell Hosts - PowerShell Module
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test ps_module windows PowerShell - Roberto Rodriguez @Cyb3rWard0g 2019-08-11 2025-10-17 64e8e417-c19a-475a-8d19-98ea705394cc
1 Alternate PowerShell Hosts Pipe
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Generic test pipe_created windows Sysmon - Roberto Rodriguez @Cyb3rWard0g, Tim Shelton 2019-09-12 2025-10-07 58cb02d5-78ce-4692-b3e1-dce850aae41a
2 AppLocker Application Would Have Been Blocked
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Generic experimental - windows AppLocker - heyyanu 2026-03-26 — 557e3bd3-7f21-495d-8d50-7c8bdfb8041c
4 AppLocker Prevented Application or Script from Running
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Generic test - windows AppLocker - Pushkarev Dmitry 2020-06-28 2025-12-03 401e5d00-b944-11ea-8f9a-00163ecd60ae
3 AWS EC2 Startup Shell Script Change
Detects changes to the EC2 instance startup script. (...)
Generic test cloud_audit - AWS CloudTrail · AWS - faloker 2020-02-12 2022-06-07 1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df
1 Bad Opsec Powershell Code Artifacts
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including
Cob (...)
Generic test ps_module windows PowerShell - ok @securonix invrep_de, oscd.community 2020-10-09 2022-12-25 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
3 Base64 Encoded PowerShell Command Detected
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-01-29 2023-01-26 e32d4572-9826-4738-b651-95fa63747e8a
1 BloodHound Collection Files
Detects default file names outputted by the BloodHound collection tool SharpHound
Generic test file_event windows Sysmon - C.J. May 2022-08-09 2026-02-19 02773bed-83bf-469f-b7ff-e676e7d78bab
1 bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
Detects powershell execution with that make use of to the bxor (Bitwise XOR). (...)
Hunting test ps_classic_start windows PowerShell - Teymur Kheirkhabarov, Harish Segar 2020-06-29 2024-12-11 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
2 Certificate Exported Via PowerShell
Detects calls to cmdlets that are used to export certificates from the local certificate store. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-05-18 — 9e716b33-63b2-46da-86a4-bd3c3b9b5dfb
3 Change PowerShell Policies to an Insecure Level
Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2021-11-01 2025-10-07 87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180
4 Change PowerShell Policies to an Insecure Level - PowerShell
Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.
Generic test ps_script windows PowerShell - frack113 2021-10-20 2023-12-14 61d0475c-173f-4844-86f7-f3eebae1c66b
3 ChromeLoader Malware Execution
Detects execution of ChromeLoader malware via a registered scheduled task
Emerging test process_creation windows Sysmon · WinEventLog Security - @kostastsale 2022-01-10 — 0a74c5a9-1b71-4475-9af2-7829d320d5c2
4 Splunk
Cisco Secure Firewall - Communication Over Suspicious Ports
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. (...)
Anomaly stable firewall - Cisco Secure Firewall · Cisco - Nasreddine Bencherchali, Splunk 2025-04-03 2026-05-13 d85c05c8-42c0-4e4a-87e7-4e1bb3e844e3
1 Splunk
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. (...)
Generic stable firewall - Cisco Secure Firewall · Cisco Nasreddine Bencherchali, Splunk, Talos NTDR 2025-04-16 2026-05-13 7b7c2e92-f0b2-48d2-9c9b-b8de52b6b2ae
2 Cmd.EXE Missing Space Characters Execution Anomaly
Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-08-23 2026-05-13 a16980c2-0c56-4de0-9a79-17971979efdd
2 Command Line Execution with Suspicious URL and AppData Strings
Detects a suspicious command line execution that includes an URL and AppData string in the command l (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community 2019-01-16 2021-11-27 1ac8666b-046f-4201-8aba-1951aaec03a3
2 ConvertTo-SecureString Cmdlet Usage Via CommandLine
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton 2020-10-11 2023-02-01 74403157-20f5-415d-89a7-c505779585cf
2 Splunk
CrushFTP Authentication Bypass Exploitation
The following analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). (...)
Generic stable file_event - CrushFTP Michael Haag, Splunk 2025-04-14 2026-09-08 82eb7f64-d219-4e21-acfe-956de84c1a35
3 CVE-2022-24527 Microsoft Connected Cache LPE
Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected (...)
Emerging test file_event windows Sysmon Florian Roth (Nextron Systems) 2022-04-13 — e0a41412-c69a-446f-8e6e-0e6d7483dad7
1 Splunk
Detect Certify With PowerShell Script Block Logging
The following analytic detects the use of the Certify tool via an in-memory PowerShell function to enumerate Active Directory Certificate Services (AD CS) environments. (...)
Generic stable ps_script windows PowerShell - Steven Dick 2023-07-28 2026-05-13 f533ca6c-9440-4686-80cb-7f294c07812a
2 Splunk
Detect Empire with PowerShell Script Block Logging
The following analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. (...)
Generic stable ps_script windows PowerShell - Michael Haag, Splunk 2021-06-09 2026-05-13 bc1dc6b8-c954-11eb-bade-acde48001122
6 Splunk
Detect Mimikatz With PowerShell Script Block Logging
The following analytic detects the execution of Mimikatz commands via PowerShell by leveraging PowerShell Script Block Logging (EventCode=4104). (...)
Generic stable ps_script windows PowerShell - Michael Haag, Splunk 2021-06-09 2026-05-13 8148c29c-c952-11eb-9255-acde48001122
5 Detection of PowerShell Execution via Sqlps.exe
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Agro (@agro_sev) oscd.community 2020-10-10 2022-12-09 0152550d-3a26-4efd-9f0e-54a0b28ae2f3
3 DSInternals Suspicious PowerShell Cmdlets
Detects execution and usage of the DSInternals PowerShell module. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri 2024-06-26 — 43d91656-a9b2-4541-b7e2-6a9bd3a13f4e
1 DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
Detects execution and usage of the DSInternals PowerShell module. (...)
Generic test ps_script windows PowerShell - Nasreddine Bencherchali (Nextron Systems) 2024-06-26 — 846c7a87-8e14-4569-9d49-ecfd4276a01c
1 Splunk
Exchange PowerShell Module Usage
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. (...)
Generic stable ps_script windows PowerShell - Michael Haag, Splunk 2021-08-25 2026-05-13 2d10095e-05ae-11ec-8fdf-acde48001122
9 Exchange PowerShell Snap-Ins Usage
Detects adding and using Exchange PowerShell snap-ins to export mailbox data. (...)
Generic test process_creation windows Sysmon · WinEventLog Security - FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems) 2021-03-03 2023-03-24 25676e10-2121-446e-80a4-71ff8506af47
3 Execute Code with Pester.bat
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Generic test process_creation windows Sysmon · WinEventLog Security - Julia Fomina, oscd.community 2020-10-08 2023-11-09 59e938ff-0d6d-4dc3-b13f-36cc28734d4e
2 Execute Code with Pester.bat as Parent
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Generic test process_creation windows Sysmon · WinEventLog Security - frack113, Nasreddine Bencherchali 2022-08-20 — 18988e1b-9087-4f8a-82fe-0414dce49878
2 Execution of Powershell Script in Public Folder
This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder
Generic test process_creation windows Sysmon · WinEventLog Security - Max Altgelt (Nextron Systems) 2022-04-06 2022-07-14 fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4
1 Exploited CVE-2020-10189 Zoho ManageEngine
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability rep (...)
Emerging test process_creation windows Sysmon · WinEventLog Security Florian Roth (Nextron Systems) 2020-03-25 2023-01-21 846b866e-2a57-46ee-8e16-85fa92759be7
2 FakeUpdates/SocGholish Activity
Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.
Emerging test process_creation windows Sysmon · WinEventLog Security - @kostastsale 2022-06-16 2024-08-23 97805087-93ab-4203-b5cb-287cda6aecaa
2 Splunk
Get-ForestTrust with PowerShell Script Block
The following analytic detects the execution of the Get-ForestTrust command from PowerSploit using PowerShell Script Block Logging (EventCode=4104). (...)
Generic stable ps_script windows PowerShell - Michael Haag, Splunk 2021-09-02 2026-05-13 70fac80e-0bf1-11ec-9ba0-acde48001122
2 Splunk
GetLocalUser with PowerShell Script Block
The following analytic detects the execution of the `Get-LocalUser` PowerShell commandlet using PowerShell Script Block Logging (EventCode=4104). (...)
Hunting stable ps_script windows PowerShell - Mauricio Velazco, Splunk 2021-08-24 2026-05-13 2e891cbe-0426-11ec-9c9c-acde48001122
2 Splunk
GetWmiObject User Account with PowerShell Script Block
The following analytic detects the execution of the `Get-WmiObject` commandlet with the `Win32_UserAccount` parameter via PowerShell Script Block Logging (EventCode=4104). (...)
Hunting stable ps_script windows PowerShell - Mauricio Velazco, Splunk 2021-08-24 2026-05-13 640b0eda-0429-11ec-accd-acde48001122
2 Greenbug Espionage Group Indicators
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)
Emerging test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2020-05-20 2023-03-09 3711eee4-a808-4849-8a14-faf733da3612
1 HackTool - Bloodhound/Sharphound Execution
Detects command line parameters used by Bloodhound and Sharphound hack tools
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-12-20 2023-02-04 f376c8a7-a2d0-4ddc-aa0c-16c17236d962
2 HackTool - Covenant PowerShell Launcher
Detects suspicious command lines used in Covenant luanchers
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community 2020-06-04 2023-02-21 c260b6db-48ba-4b4a-a76f-2f67644e99d2
1 HackTool - CrackMapExec Execution
This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2022-02-25 2023-03-08 42a993dd-bb3e-48c8-b372-4d6684c4106c
4 HackTool - CrackMapExec Execution Patterns
Detects various execution patterns of the CrackMapExec pentesting framework
Generic stable process_creation windows Sysmon · WinEventLog Security - Thomas Patzke 2020-05-22 2023-11-06 058f4380-962d-40a5-afce-50207d36d7e2
1 HackTool - CrackMapExec PowerShell Obfuscation
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Generic test process_creation windows Sysmon · WinEventLog Security - Thomas Patzke 2020-05-22 2023-02-21 6f8b3439-a203-45dc-a88b-abf57ea15ccf
2 HackTool - Default PowerSploit/Empire Scheduled Task Creation
Detects the creation of a schtask via PowerSploit or Empire Default Configuration.
Generic test process_creation windows Sysmon · WinEventLog Security - Markus Neis, @Karneades 2018-03-06 2023-03-03 56c217c3-2de2-479b-990f-5c109ba8458f
2 HackTool - Empire PowerShell Launch Parameters
Detects suspicious powershell command line parameters used in Empire
Generic test process_creation windows Sysmon · WinEventLog Security - Florian Roth (Nextron Systems) 2019-04-20 2023-02-21 79f4ede3-402e-41c8-bc3e-ebbf5f162581
4 Headless Process Launched Via Conhost.EXE
Detects the launch of a child process via "conhost.exe" with the "--headless" flag. (...)
Hunting test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2024-07-23 — 00ca75ab-d5ce-43be-b86c-55ff39c6abfc
1 Hidden Powershell in Link File Pattern
Detects events that appear when a user click on a link file with a powershell command in it
Generic test process_creation windows Sysmon · WinEventLog Security - frack113 2022-02-06 — 30e92f50-bb5a-4884-98b5-d20aa80f3d7a
1 HTML Help HH.EXE Suspicious Child Process
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Generic test process_creation windows Sysmon · WinEventLog Security - Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems) 2020-04-01 2023-04-12 52cad028-0ff0-4854-8f67-d25dfcbc78b4
4 Import PowerShell Modules From Suspicious Directories
Detects powershell scripts that import modules from suspicious directories
Generic test ps_script windows PowerShell - Nasreddine Bencherchali (Nextron Systems) 2022-07-07 2023-01-10 21f9162c-5f5d-4b01-89a8-b705bd7d10ab
1 Import PowerShell Modules From Suspicious Directories - ProcCreation
Detects powershell scripts that import modules from suspicious directories
Generic test process_creation windows Sysmon · WinEventLog Security - Nasreddine Bencherchali (Nextron Systems) 2023-01-10 — c31364f7-8be6-4b77-8483-dd2b5a7b69a3
1 Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. (...)
Hunting test process_creation windows Sysmon · WinEventLog Security - Andreas Braathen (mnemonic.io) 2023-12-01 — ad856965-f44d-42a8-945e-bbf7bd03d05a
3