Suspicious obfuscation or deobfuscation activity - Suspicious script execution - A script with suspicious content was observed - PowerShell dropped a suspicious file on the machine - Anomalous process executing encoded command - Suspicious dynamic link library loaded - An anomalous scheduled task was created - An uncommon file was created and added to a Run Key - Suspicious screen capture activity - Staging of sensitive data - Suspicious process transferring data to external network