PowerShell

5 events across 1 channel

Event	Title	Channel	Sample
300	Event ID 300	Windows PowerShell	Y
400	Event ID 400	Windows PowerShell	Y
403	Event ID 403	Windows PowerShell	Y
600	Event ID 600	Windows PowerShell	Y
800	Event ID 800	Windows PowerShell	Y

Event ID 300

Provider: PowerShell
Channel: Windows PowerShell
Level: Warning
Collection Priority: Recommended (Olaf Hartong)

Fields #

Name	Description
`Data_0`
`Data_1`
`Binary`

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 300,
    "version": 0,
    "level": 3,
    "task": 3,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T14:36:40.9532632+00:00",
    "event_record_id": 248590,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "telemetry-DC-a.cell-a.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Could not find the drive 'Z:\\'. The drive might not be ready or might not be mapped.",
    "Data_1": "\tProviderName=Microsoft.PowerShell.Core\\FileSystem\n\tExceptionClass=DriveNotFoundException\n\tErrorCategory=\n\tErrorId=\n\tErrorMessage=Could not find the drive 'Z:\\'. The drive might not be ready or might not be mapped.\n\n\tSeverity=Warning\n\n\tSequenceNumber=82233\n\n\tHostName=ServerRemoteHost\n\tHostVersion=1.0.0.0\n\tHostId=e8ecf392-16f7-461a-9e04-2cf3b693e616\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n\tEngineVersion=5.1.20348.558\n\tRunspaceId=7d22a55e-f35a-436b-aadc-c65ab73a8891\n\tPipelineId=4684\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine="
  },
  "message": "Provider Health: Could not find the drive 'Z:\\'. The drive might not be ready or might not be mapped.. \r\n\r\nDetails: \r\n\tProviderName=Microsoft.PowerShell.Core\\FileSystem\r\n\tExceptionClass=DriveNotFoundException\r\n\tErrorCategory=\r\n\tErrorId=\r\n\tErrorMessage=Could not find the drive 'Z:\\'. The drive might not be ready or might not be mapped.\r\n\r\n\tSeverity=Warning\r\n\r\n\tSequenceNumber=82233\r\n\r\n\tHostName=ServerRemoteHost\r\n\tHostVersion=1.0.0.0\r\n\tHostId=e8ecf392-16f7-461a-9e04-2cf3b693e616\r\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\r\n\tEngineVersion=5.1.20348.558\r\n\tRunspaceId=7d22a55e-f35a-436b-aadc-c65ab73a8891\r\n\tPipelineId=4684\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="
}

Event ID 400

Provider: PowerShell
Channel: Windows PowerShell
Level: Informational
Collection Priority: Recommended (ASD, others)

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 400,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T14:08:49.4449408+00:00",
    "event_record_id": 135234,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Available",
    "Data_1": "None",
    "Data_2": "\tNewEngineState=Available\n\tPreviousEngineState=None\n\n\tSequenceNumber=13\n\n\tHostName=ServerRemoteHost\n\tHostVersion=1.0.0.0\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n\tEngineVersion=5.1.20348.558\n\tRunspaceId=55ce38e0-81ea-44db-9a08-0c9965b78525\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine="
  },
  "message": "Engine state is changed from None to Available. \r\n\r\nDetails: \r\n\tNewEngineState=Available\r\n\tPreviousEngineState=None\r\n\r\n\tSequenceNumber=13\r\n\r\n\tHostName=ServerRemoteHost\r\n\tHostVersion=1.0.0.0\r\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\r\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\r\n\tEngineVersion=5.1.20348.558\r\n\tRunspaceId=55ce38e0-81ea-44db-9a08-0c9965b78525\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Data`	contains	`engineversion=2.`	2 rules	sigma
`Data`	contains	`hostname=consolehost`	2 rules	sigma

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Nslookup PowerShell Download Cradle source medium: Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
Delete Volume Shadow Copies Via WMI With PowerShell source high: Shadow Copies deletion using operating systems utilities via PowerShell
PowerShell Downgrade Attack - PowerShell source medium: Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Show 8 more (11 total)

PowerShell Download Via Net.WebClient - PowerShell Classic source low: Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.
PowerShell Called from an Executable Version Mismatch source high: Detects PowerShell called from an executable by the version mismatch method
Netcat The Powershell Version source medium: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Remote PowerShell Session (PS Classic) source low: Detects remote PowerShell sessions
Renamed Powershell Under Powershell Channel source low: Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
Use Get-NetTCPConnection source low: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Uncommon PowerShell Hosts source medium: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
bXOR Operator Usage In PowerShell Command Line - PowerShell Classic source low: Detects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.

References #

Microsoft Learn https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

Event ID 403

Provider: PowerShell
Channel: Windows PowerShell
Level: Informational
Collection Priority: Recommended (Olaf Hartong)

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 403,
    "version": 0,
    "level": 4,
    "task": 4,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T13:49:48.1625912+00:00",
    "event_record_id": 135113,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Stopped",
    "Data_1": "Available",
    "Data_2": "\tNewEngineState=Stopped\n\tPreviousEngineState=Available\n\n\tSequenceNumber=37\n\n\tHostName=ServerRemoteHost\n\tHostVersion=1.0.0.0\n\tHostId=0b367628-0beb-4200-bd3b-d971f76266ad\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n\tEngineVersion=5.1.20348.558\n\tRunspaceId=80e8efda-cc77-49f0-ba78-d2a73183482b\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine="
  },
  "message": "Engine state is changed from Available to Stopped. \r\n\r\nDetails: \r\n\tNewEngineState=Stopped\r\n\tPreviousEngineState=Available\r\n\r\n\tSequenceNumber=37\r\n\r\n\tHostName=ServerRemoteHost\r\n\tHostVersion=1.0.0.0\r\n\tHostId=0b367628-0beb-4200-bd3b-d971f76266ad\r\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\r\n\tEngineVersion=5.1.20348.558\r\n\tRunspaceId=80e8efda-cc77-49f0-ba78-d2a73183482b\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="
}

References #

Microsoft Learn https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

Event ID 600

Provider: PowerShell
Channel: Windows PowerShell
Level: Informational

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 600,
    "version": 0,
    "level": 4,
    "task": 6,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T14:08:49.4449408+00:00",
    "event_record_id": 135233,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "Variable",
    "Data_1": "Started",
    "Data_2": "\tProviderName=Variable\n\tNewProviderState=Started\n\n\tSequenceNumber=11\n\n\tHostName=ServerRemoteHost\n\tHostVersion=1.0.0.0\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n\tEngineVersion=\n\tRunspaceId=\n\tPipelineId=\n\tCommandName=\n\tCommandType=\n\tScriptName=\n\tCommandPath=\n\tCommandLine="
  },
  "message": "Provider \"Variable\" is Started. \r\n\r\nDetails: \r\n\tProviderName=Variable\r\n\tNewProviderState=Started\r\n\r\n\tSequenceNumber=11\r\n\r\n\tHostName=ServerRemoteHost\r\n\tHostVersion=1.0.0.0\r\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\r\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\r\n\tEngineVersion=\r\n\tRunspaceId=\r\n\tPipelineId=\r\n\tCommandName=\r\n\tCommandType=\r\n\tScriptName=\r\n\tCommandPath=\r\n\tCommandLine="
}

Detection Rules #

View all rules referencing this event →

Sigma # view in coverage

Tamper Windows Defender - PSClassic source high: Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Event ID 800

Provider: PowerShell
Channel: Windows PowerShell
Level: Informational
Collection Priority: Recommended (Microsoft-WEF, others)

Fields #

Name	Description
`Data_0`
`Data_1`
`Data_2`
`Binary`

Example Event #

{
  "system": {
    "provider": "PowerShell",
    "guid": "",
    "event_source_name": "",
    "event_id": 800,
    "version": 0,
    "level": 4,
    "task": 8,
    "opcode": 0,
    "keywords": 36028797018963968,
    "time_created": "2026-06-13T14:11:01.1637860+00:00",
    "event_record_id": 135268,
    "correlation": {},
    "execution": {
      "process_id": 0,
      "thread_id": 0
    },
    "channel": "Windows PowerShell",
    "computer": "telemetry-DC-c.cell-c.ludus.domain",
    "security": {
      "user_id": ""
    }
  },
  "event_data": {
    "Data_0": "    return ($recs | ConvertTo-Json -Depth 14 -Compress)\n",
    "Data_1": "\tDetailSequence=1\n\tDetailTotal=1\n\n\tSequenceNumber=39\n\n\tUserId=cell-c\\domainadmin\n\tHostName=ServerRemoteHost\n\tHostVersion=1.0.0.0\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\n\tEngineVersion=5.1.20348.558\n\tRunspaceId=55ce38e0-81ea-44db-9a08-0c9965b78525\n\tPipelineId=8\n\tScriptName=\n\tCommandLine=    return ($recs | ConvertTo-Json -Depth 14 -Compress)\n",
    "Data_2": "CommandInvocation(ConvertTo-Json): \"ConvertTo-Json\"\nParameterBinding(ConvertTo-Json): name=\"Depth\"; value=\"14\"\nParameterBinding(ConvertTo-Json): name=\"Compress\"; value=\"True\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\n"
  },
  "message": "Pipeline execution details for command line:     return ($recs | ConvertTo-Json -Depth 14 -Compress)\n. \r\n\r\nContext Information: \r\n\tDetailSequence=1\r\n\tDetailTotal=1\r\n\r\n\tSequenceNumber=39\r\n\r\n\tUserId=cell-c\\domainadmin\r\n\tHostName=ServerRemoteHost\r\n\tHostVersion=1.0.0.0\r\n\tHostId=aa212afc-f66e-4e09-a428-4989b19010a1\r\n\tHostApplication=C:\\Windows\\system32\\wsmprovhost.exe -Embedding\r\n\tEngineVersion=5.1.20348.558\r\n\tRunspaceId=55ce38e0-81ea-44db-9a08-0c9965b78525\r\n\tPipelineId=8\r\n\tScriptName=\r\n\tCommandLine=    return ($recs | ConvertTo-Json -Depth 14 -Compress)\n \r\n\r\nDetails: \r\nCommandInvocation(ConvertTo-Json): \"ConvertTo-Json\"\r\nParameterBinding(ConvertTo-Json): name=\"Depth\"; value=\"14\"\r\nParameterBinding(ConvertTo-Json): name=\"Compress\"; value=\"True\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\nParameterBinding(ConvertTo-Json): name=\"InputObject\"; value=\"System.Collections.Specialized.OrderedDictionary\"\r\n"
}

Detection Patterns #

PowerShell Event ID 4103: Payload Context: ContextInfo User Data: UserData.OREvent ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).ORPowerShell Event ID 800

37 rules

Sigma

PipeShell exfiltration over named pipes (source)

mdecrevoisier

Payload downloaded via PowerShell (source)

mdecrevoisier

Encoded PowerShell payload deployed (PowerShell) (source)

mdecrevoisier

Show 34 more (37 total) on the rules page

Group Membership Change

PowerShell Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).ORPowerShell Event ID 800

3 rules

Sigma

DSRM password changed (Reg via PowerShell) (source)

mdecrevoisier

Domain group membership change (source)

mdecrevoisier

Local group membership change (source)

mdecrevoisier

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`EventData`	contains	`-itemproperty`	5 rules	sigma
`EventData`	contains	`.dll`	3 rules	sigma
`EventData`	contains	`name`	3 rules	sigma
`EventData`	contains	`set-mppreference`	3 rules	sigma
`EventData`	contains	`\system\currentcontrolset\services\`	2 rules	sigma
`EventData`	contains	`add-mppreference`	2 rules	sigma
`EventData`	contains	`ftp://`	2 rules	sigma
`EventData`	contains	`http://`	2 rules	sigma
`EventData`	contains	`https://`	2 rules	sigma
`Payload`	contains	`-itemproperty`	5 rules	sigma
`Payload`	contains	`.dll`	3 rules	sigma
`Payload`	contains	`name`	3 rules	sigma
`ScriptBlockText`	contains	`-itemproperty`	5 rules	sigma
`ScriptBlockText`	contains	`.dll`	3 rules	sigma
`ScriptBlockText`	contains	`name`	3 rules	sigma

References #

Microsoft Learn https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

PowerShell

Event ID 300

Fields #

Example Event #

Event ID 400

Fields #

Example Event #

Common Indicators #

Detection Rules #

Sigma # view in coverage

References #

Event ID 403

Fields #

Example Event #

References #

Event ID 600

Fields #

Example Event #

Detection Rules #

Sigma # view in coverage

Event ID 800

Fields #

Example Event #

Detection Patterns #

Sigma

Group Membership Change

Sigma

Common Indicators #

References #

Keyboard shortcuts

Search operators