deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Potential Active Directory Enumeration Using AD Module - PsScript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali
Date: 2023-01-22
Log source: windows/ps_script

Description:
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Detection logic:
{
  "selection_generic": {
    "ScriptBlockText|contains|all": [
      "Import-Module ",
      "Microsoft.ActiveDirectory.Management.dll"
    ]
  },
  "selection_specific": {
    "ScriptBlockText|contains": "ipmo Microsoft.ActiveDirectory.Management.dll"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]66061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
Sigma Detection Rule: Potential Unconstrained Delegation Discovery Via Get-ADComputer - ScriptBlock
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: frack113
Date: 2025-03-05
ATT&CK techniques: T1018, T1558, T1589.002
Log source: windows/ps_script

Description:
Detects the use of the "Get-ADComputer" cmdlet in order to identify systems which are configured for unconstrained delegation.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "-Properties*TrustedForDelegation",
      "-Properties*TrustedToAuthForDelegation",
      "-Properties*msDS-AllowedToDelegateTo",
      "-Properties*PrincipalsAllowedToDelegateToAccount",
      "-LDAPFilter*(userAccountControl:1.2.840.113556.1.4.803:=524288)"
    ]
  },
  "condition": "selection"
}

References:
  - https://pentestlab.blog/2022/03/21/unconstrained-delegation/
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer?view=windowsserver2022-ps
Sigma Detection Rule: Active Directory Group Enumeration With Get-AdGroup
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1069.002
Log source: windows/ps_script

Description:
Detects usage of the "Get-AdGroup" cmdlet to enumerate Groups within Active Directory

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-AdGroup ",
      "-Filter"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
Sigma Detection Rule: Change PowerShell Policies to an Insecure Level - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-10-20
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": "Set-ExecutionPolicy"
  },
  "selection_option": {
    "ScriptBlockText|contains": [
      "Unrestricted",
      "bypass"
    ]
  },
  "filter_optional_chocolatey": {
    "ScriptBlockText|contains": [
      "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1')",
      "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
    ]
  },
  "condition": "all of selection_* and not 1 of filter_optional_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
  - https://adsecurity.org/?p=2604
Sigma Detection Rule: WMIC Unquoted Services Path Lookup - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-20
ATT&CK techniques: T1047
Log source: windows/ps_script

Description:
Detects known WMI recon method to look for unquoted service paths, often used by pentest inside of powershell scripts attackers enum scripts

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Get-WmiObject ",
      "gwmi "
    ],
    "ScriptBlockText|contains|all": [
      " Win32_Service ",
      "Name",
      "DisplayName",
      "PathName",
      "StartMode"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py
  - https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Sigma Detection Rule: Usage Of Web Request Commands And Cmdlets - ScriptBlock
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: James Pemberton / @4A616D6573
Date: 2019-10-24
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "[System.Net.WebRequest]::create",
      "curl ",
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      " irm ",
      "iwr ",
      "Resume-BitsTransfer",
      "Start-BitsTransfer",
      "wget ",
      "WinHttp.WinHttpRequest"
    ]
  },
  "filter": {
    "Path|startswith": "C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\"
  },
  "condition": "selection and not filter"
}

References:
  - https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/
  - https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell
Sigma Detection Rule: Unsigned AppX Installation Attempt Using Add-AppxPackage - PsScript
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-31
Log source: windows/ps_script

Description:
Detects usage of the "Add-AppxPackage" or it's alias "Add-AppPackage" to install unsigned AppX packages

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "Add-AppPackage ",
      "Add-AppxPackage "
    ]
  },
  "selection_flag": {
    "ScriptBlockText|contains": " -AllowUnsigned"
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
  - https://twitter.com/WindowsDocs/status/[PII_REDACTED]80325122
Sigma Detection Rule: Potential Invoke-Mimikatz PowerShell Script
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-28
ATT&CK techniques: T1003
Log source: windows/ps_script

Description:
Detects Invoke-Mimikatz PowerShell script and alike. Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.

Detection logic:
{
  "selection_1": {
    "ScriptBlockText|contains|all": [
      "DumpCreds",
      "DumpCerts"
    ]
  },
  "selection_2": {
    "ScriptBlockText|contains": "sekurlsa::logonpasswords"
  },
  "selection_3": {
    "ScriptBlockText|contains|all": [
      "crypto::certificates",
      "CERT_SYSTEM_STORE_LOCAL_MACHINE"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://www.elastic.co/guide/en/security/current/potential-invoke-mimikatz-powershell-script.html#potential-invoke-mimikatz-powershell-script
Sigma Detection Rule: User Discovery And Export Via Get-ADUser Cmdlet - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-17
ATT&CK techniques: T1033
Log source: windows/ps_script

Description:
Detects usage of the Get-ADUser cmdlet to collect user information and output it to a file

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-ADUser ",
      " -Filter \\*"
    ],
    "ScriptBlockText|contains": [
      " > ",
      " | Select ",
      "Out-File",
      "Set-Content",
      "Add-Content"
    ]
  },
  "condition": "selection"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
Sigma Detection Rule: DMSA Service Account Created in Specific OUs - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-24
ATT&CK techniques: T1078.002, T1098
Log source: windows/ps_script

Description:
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-ADServiceAccount",
      "-CreateDelegatedServiceAccount",
      "-path"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
Sigma Detection Rule: AD Groups Or Users Enumeration Using PowerShell - ScriptBlock
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1069.001
Log source: windows/ps_script

Description:
Adversaries may attempt to find domain-level groups and permission settings.
The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.
Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.


Detection logic:
{
  "test_2": {
    "ScriptBlockText|contains": "get-ADPrincipalGroupMembership"
  },
  "test_7": {
    "ScriptBlockText|contains|all": [
      "get-aduser",
      "-f ",
      "-pr ",
      "DoesNotRequirePreAuth"
    ]
  },
  "condition": "1 of test_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
Sigma Detection Rule: Add Windows Capability Via PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-22
Log source: windows/ps_script

Description:
Detects usage of the "Add-WindowsCapability" cmdlet to add Windows capabilities. Notable capabilities could be "OpenSSH" and others.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": "Add-WindowsCapability "
  },
  "selection_capa": {
    "ScriptBlockText|contains": "-Name OpenSSH."
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell
  - https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content
Sigma Detection Rule: Powershell Execute Batch Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-02
ATT&CK techniques: T1059.003
Log source: windows/ps_script

Description:
Adversaries may abuse the Windows command shell for execution.
The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems.
The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.
Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.
Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system


Detection logic:
{
  "selection_start": {
    "ScriptBlockText|contains": "Start-Process"
  },
  "selection_batch": {
    "ScriptBlockText|contains": [
      ".cmd",
      ".bat"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.003/T1059.003.md#atomic-test-1---create-and-execute-batch-script
Sigma Detection Rule: Silence.EDA Detection
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Alina Stepchenkova, Group-IB, oscd.community
Date: 2019-11-01
ATT&CK techniques: T1059.001, T1071.004, T1572, T1529
Log source: windows/ps_script

Description:
Detects Silence EmpireDNSAgent as described in the Group-IP report

Detection logic:
{
  "empire": {
    "ScriptBlockText|contains|all": [
      "System.Diagnostics.Process",
      "Stop-Computer",
      "Restart-Computer",
      "Exception in execution",
      "$cmdargs",
      "Close-Dnscat2Tunnel"
    ]
  },
  "dnscat": {
    "ScriptBlockText|contains|all": [
      "set type=$LookupType`nserver",
      "$Command | nslookup 2>&1 | Out-String",
      "New-RandomDNSField",
      "[Convert]::ToString($SYNOptions, 16)",
      "$Session.Dead = $True",
      "$Session[\"Driver\"] -eq"
    ]
  },
  "condition": "empire and dnscat"
}

References:
  - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
Sigma Detection Rule: Powershell LocalAccount Manipulation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1098
Log source: windows/ps_script

Description:
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Disable-LocalUser",
      "Enable-LocalUser",
      "Get-LocalUser",
      "Set-LocalUser",
      "New-LocalUser",
      "Rename-LocalUser",
      "Remove-LocalUser"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1098/T1098.md#atomic-test-1---admin-account-manipulate
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.localaccounts/?view=powershell-5.1
Sigma Detection Rule: PowerShell ADRecon Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-07-16
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Function Get-ADRExcelComOb",
      "Get-ADRGPO",
      "Get-ADRDomainController",
      "ADRecon-Report.xlsx"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1
  - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
Sigma Detection Rule: Suspicious Unblock-File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-01
ATT&CK techniques: T1553.005
Log source: windows/ps_script

Description:
Remove the Zone.Identifier alternate data stream which identifies the file as downloaded from the internet.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Unblock-File ",
      "-Path "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-3---remove-the-zoneidentifier-alternate-data-stream
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/unblock-file?view=powershell-7.2
Sigma Detection Rule: Invoke-Obfuscation STDIN+ Launcher - Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated use of stdin to execute PowerShell

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "cmd.{0,5}(?:/c|/r).+powershell.+(?:\\$?\\{?input\\}?|noexit).+\""
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Suspicious X509Enrollment - Ps Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-23
ATT&CK techniques: T1553.004
Log source: windows/ps_script

Description:
Detect use of X509Enrollment

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "X509Enrollment.CBinaryConverter",
      "884e2002-217d-11da-b2a4-000e7bbb2b09"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41
  - https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115
Sigma Detection Rule: Suspicious Get Local Groups Information - PowerShell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-12
ATT&CK techniques: T1069.001
Log source: windows/ps_script

Description:
Detects the use of PowerShell modules and cmdlets to gather local group information.
Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.


Detection logic:
{
  "selection_localgroup": {
    "ScriptBlockText|contains": [
      "get-localgroup ",
      "get-localgroupmember "
    ]
  },
  "selection_wmi_module": {
    "ScriptBlockText|contains": [
      "get-wmiobject ",
      "gwmi ",
      "get-ciminstance ",
      "gcim "
    ]
  },
  "selection_wmi_class": {
    "ScriptBlockText|contains": "win32_group"
  },
  "condition": "selection_localgroup or all of selection_wmi_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
Sigma Detection Rule: PowerShell Set-Acl On Windows Folder - PsScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-18
ATT&CK techniques: T1222
Log source: windows/ps_script

Description:
Detects PowerShell scripts to set the ACL to a file in the Windows folder

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains|all": [
      "Set-Acl ",
      "-AclObject "
    ]
  },
  "selection_paths": {
    "ScriptBlockText|contains": [
      "-Path \"C:\\Windows",
      "-Path \"C:/Windows",
      "-Path 'C:\\Windows",
      "-Path 'C:/Windows",
      "-Path C:\\\\Windows",
      "-Path C:/Windows",
      "-Path $env:windir",
      "-Path \"$env:windir",
      "-Path '$env:windir"
    ]
  },
  "selection_permissions": {
    "ScriptBlockText|contains": [
      "FullControl",
      "Allow"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1505.005/T1505.005.md
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-acl?view=powershell-5.1
Sigma Detection Rule: Suspicious IO.FileStream
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-09
ATT&CK techniques: T1070.003
Log source: windows/ps_script

Description:
Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "IO.FileStream",
      "\\\\\\\\.\\\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1006/T1006.md
Sigma Detection Rule: Powershell MsXml COM Object
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, MatilJ
Date: 2022-01-19
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "-ComObject",
      "MsXml2.",
      "XmlHttp"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt
  - https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)
  - https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
Sigma Detection Rule: Potential WinAPI Calls Via PowerShell Scripts
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community
Date: 2020-10-06
ATT&CK techniques: T1059.001, T1106
Log source: windows/ps_script

Description:
Detects use of WinAPI functions in PowerShell scripts

Detection logic:
{
  "selection_injection": {
    "ScriptBlockText|contains|all": [
      "VirtualAlloc",
      "OpenProcess",
      "WriteProcessMemory",
      "CreateRemoteThread"
    ]
  },
  "selection_token_steal": {
    "ScriptBlockText|contains|all": [
      "OpenProcessToken",
      "LookupPrivilegeValue",
      "AdjustTokenPrivileges"
    ]
  },
  "selection_duplicate_token": {
    "ScriptBlockText|contains|all": [
      "OpenProcessToken",
      "DuplicateTokenEx",
      "CloseHandle"
    ]
  },
  "selection_process_write_read": {
    "ScriptBlockText|contains|all": [
      "WriteProcessMemory",
      "VirtualAlloc",
      "ReadProcessMemory",
      "VirtualFree"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse