diff --git a/host-interaction/file-system/create/create-directory.yml b/host-interaction/file-system/create/create-directory.yml
index aa7543ca..1bc087d0 100644
--- a/host-interaction/file-system/create/create-directory.yml
+++ b/host-interaction/file-system/create/create-directory.yml
@@ -9,6 +9,7 @@ rule:
       - File System::Create Directory [C0046]
     examples:
       - Practical Malware Analysis Lab 17-02.dll_:0x10008f62
+      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003
   features:
     - or:
       - api: kernel32.CreateDirectory
@@ -20,3 +21,4 @@ rule:
       - api: SHCreateDirectoryEx
       - api: _mkdir
       - api: _wmkdir
+      - api: System.IO.Directory::CreateDirectory
diff --git a/host-interaction/process/create/create-process-on-windows.yml b/host-interaction/process/create/create-process-on-windows.yml
index d37402ec..c0f4c8db 100644
--- a/host-interaction/process/create/create-process-on-windows.yml
+++ b/host-interaction/process/create/create-process-on-windows.yml
@@ -10,6 +10,7 @@ rule:
     examples:
       - 9324D1A8AE37A36AE560C37448C9705A:0x406DB0
       - Practical Malware Analysis Lab 01-04.exe_:0x4011FC
+      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003
   features:
     - and:
       - os: windows
@@ -29,3 +30,4 @@ rule:
         - api: ZwCreateProcessEx
         - api: ntdll.ZwCreateUserProcess
         - api: ntdll.RtlCreateUserProcess
+        - api: System.Diagnostics.Process::Start
diff --git a/host-interaction/registry/create-or-open-registry-key.yml b/host-interaction/registry/create-or-open-registry-key.yml
index 561225af..16acac68 100644
--- a/host-interaction/registry/create-or-open-registry-key.yml
+++ b/host-interaction/registry/create-or-open-registry-key.yml
@@ -14,6 +14,7 @@ rule:
       - 493167E85E45363D09495D0841C30648:0x404D60
       - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x4045F2
       - B5F85C26D7AA5A1FB4AF5821B6B5AB9B:0x40433E
+      - 692f7fd6d198e804d6af98eb9e390d61:0x6000003
   features:
     - or:
       - api: advapi32.RegOpenKey
@@ -35,3 +36,4 @@ rule:
       - api: SHRegOpenUSKey
       - api: SHRegCreateUSKey
       - api: RtlCreateRegistryKey
+      - api: Microsoft.Win32.RegistryKey::OpenSubKey
diff --git a/nursery/run-powershell-expression.yml b/load-code/powershell/run-powershell-expression.yml
similarity index 62%
rename from nursery/run-powershell-expression.yml
rename to load-code/powershell/run-powershell-expression.yml
index df5c6d5d..8437a6af 100644
--- a/nursery/run-powershell-expression.yml
+++ b/load-code/powershell/run-powershell-expression.yml
@@ -7,11 +7,16 @@ rule:
     scope: function
     att&ck:
       - Execution::Command and Scripting Interpreter::PowerShell [T1059.001]
+    examples:
+      - 692f7fd6d198e804d6af98eb9e390d61:0x6000004
   features:
     - and:
       - or:
         - string: / iex\(/i
         - string: / iex /i
         - string: /Invoke-Expression/i
+        - api: System.Management.Automation.PowerShell::Create
+        - api: System.Management.Automation.PowerShell::AddScript
+        - api: System.Management.Automation.PowerShell::Invoke
       - optional:
         - substring: "powershell.exe "