Sigma detection rules, expert-reviewed

Suspicious PowerShell WebClient Download of Executable Payload

This rule detects PowerShell instantiating a dotnet WebClient object and invoking DownloadFile to retrieve a payload which the Dagon Locker intrusion used to pull a follow on DLL from a public file sharing host and this matters because the WebClient DownloadFile pattern is a widely abused fileless download primitive that fetches second stage tooling onto the host.

Suspicious PowerShell Download of Disguised Payload to ProgramData

This rule detects PowerShell using invoke webrequest with an output file argument writing into ProgramData which the OneNote intrusion used to fetch an image disguised loader and this matters because scripted downloads that stage remote content into ProgramData under a benign extension are a common IcedID delivery step and warrant investigation.

Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key

This rule detects a Run key persistence entry being written that points to a PowerShell SOCKS proxy script as used by the SystemBC component in the Gootloader intrusion to maintain a proxied channel and this matters because autorun entries launching PowerShell proxy scripts from staging folders are strong indicators of malware backed persistence and covert C2 tunneling.

Malicious Script Host Spawning PowerShell in Gootloader Chain

This rule detects the Windows script hosts wscript or cscript launching PowerShell which mirrors the Gootloader execution chain that moved from a scheduled task through script hosts into a PowerShell payload and this matters because a script host spawning PowerShell is a classic fileless loader pattern used by Gootloader and similar JavaScript droppers.

Suspicious PsExec Service Launching Encoded PowerShell Payload

This rule detects the PsExec service process spawning PowerShell with an encoded command, a lateral movement and payload delivery pattern used by Spirals ransomware operators against remote hosts.

Suspicious PowerShell Remote Script Execution via IEX DownloadString

This rule detects PowerShell downloading and directly executing a remote script through IEX and DownloadString, a fileless execution and staging technique used by Seedworm to run tooling from an attacker staging server.

Suspicious Active Directory Reconnaissance via In-Memory Offensive PowerShell (via ps_script)

This rule detects execution of offensive PowerShell tooling used by Weaver Ant for lateral movement and Active Directory reconnaissance, including an SMB client and domain enumeration functions loaded in memory. These function names correspond to SharpView and SMB client tradecraft rather than standard administration.

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

This rule detects the SharePoint IIS worker process w3wp.exe spawning PowerShell with an encoded command argument. Following exploitation of the ToolShell vulnerabilities CVE-2025-49704 and CVE-2025-49706, attackers executed encoded PowerShell from the web service context to steal machine keys and deploy web shells. This parent child chain rarely occurs during normal SharePoint operation.

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

This rule detects an IIS worker process loading the System Management Automation assembly, which enables PowerShell execution without launching powershell.exe. Weaver Ant used this technique from a web shell to run PowerShell in memory while evading process based detection. Web server worker processes do not normally load this assembly.

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

This rule detects a CurrentVersion Run or RunOnce registry value whose data references a .ps1 PowerShell script, the persistence used in the GST-phishing campaign to relaunch the Remcos RAT loader at logon. A Run key pointing at a script rather than a signed executable is an atypical auto-start that lets the multi-stage .NET chain re-establish itself, so catching the registry write exposes persistence early.

Suspicious Hidden PowerShell Spawned by Script Host via process_creation

This rule detects the Windows Script Host wscript.exe or cscript.exe launching PowerShell with a hidden window, the initial execution chain of the multi-stage Phantom Stealer campaign that runs an obfuscated .ps1 via COM. A JScript dropper invoking hidden PowerShell is a common trusted-workflow abuse pattern used to stage the reflective .NET loader, so detecting the chain surfaces the infection at its entry point.

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

This rule detects the obfuscated PowerShell command line used by FIN7 to launch the Powertrash loader and stage its implants. The activity combines an execution policy bypass, a hidden window, and a non-interactive session, typically alongside an encoded payload. This flag combination is uncommon in benign automation.

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

This rule detects PowerShell script content that reconstructs a payload using bitwise XOR over character and integer conversions. The ErrTraffic ClickFix framework delivers this XORed loader through fake browser fix prompts on compromised WordPress sites. Byte level XOR decoding inside a script block is a common obfuscation used to hide downloader logic.

Suspicious PowerShell Payload Staging in HKCU Printers Registry Key

This rule detects PowerShell that reads or writes payload data under the HKCU Printers registry key while using DPAPI SecureString conversion. Gamaredon GammaSteel hides encrypted PowerShell stages in this uncommon location and decodes them with ConvertTo-SecureString at runtime. Combining the Printers key with SecureString cryptography in a script is a distinctive fileless staging pattern.

Malicious Reflective Assembly Loading via PowerShell (via ps_script)

This rule detects PowerShell reflectively loading a .NET assembly through the Reflection Assembly Load method. The multi-stage infection chains extract shellcode or a managed payload embedded in a JPEG and load it directly in memory to evade disk-based detection. Reflective assembly loading is a strong indicator of in-memory payload execution.