diff --git a/backend/app/services/procedure_extraction_service.py b/backend/app/services/procedure_extraction_service.py
index c6ee344..1068832 100644
--- a/backend/app/services/procedure_extraction_service.py
+++ b/backend/app/services/procedure_extraction_service.py
@@ -48,7 +48,9 @@ _COMMAND_LINE_RE = re.compile(
           netsh|wmic|schtasks|sc|rundll32|regsvr32|msiexec|certutil|
           mimikatz\S*|cscript|wscript|osascript|openssl|systemctl|service|
           reg\s+query|whoami|nslookup|dig|ping|tasklist|ps\s|kill|
-          Invoke-\S+|iex|dsquery|nltest)\b
+          Invoke-\S+|iex|dsquery|nltest|
+          sysmon\S*|wevtutil|auditpol|tcpdump|tshark|procmon\S*|autorunsc\S*|
+          volatility\S*)\b
     |
     \bSELECT\s+.+\s+FROM\b               # SQL
     |
diff --git a/backend/tests/test_procedure_extraction_service.py b/backend/tests/test_procedure_extraction_service.py
index acef726..b4ac522 100644
--- a/backend/tests/test_procedure_extraction_service.py
+++ b/backend/tests/test_procedure_extraction_service.py
@@ -95,3 +95,15 @@ def test_known_binary_at_start_of_line_is_recognized():
     text = "Notes: used the following.\nsudo tcpdump -i eth0 -w capture.pcap\nCaptured 500 packets."
     result = extract_commands(text)
     assert result == "sudo tcpdump -i eth0 -w capture.pcap"
+
+
+def test_recognizes_sysmon_as_a_detection_command():
+    text = "launch sysmon to detect\nsysmon.exe\nthen search this query\n\\? mimikatz \\n"
+    result = extract_commands(text)
+    assert result == "sysmon.exe"
+
+
+def test_recognizes_wevtutil_and_auditpol():
+    text = "Pulled the security log.\nwevtutil qe Security /c:5\nThen checked audit policy.\nauditpol /get /category:*"
+    result = extract_commands(text)
+    assert result == "wevtutil qe Security /c:5\nauditpol /get /category:*"