Sigma detection rules, expert-reviewed

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

This rule detects wscript or cscript launching PowerShell with a hidden window. This layered email loader uses WMI-spawned hidden PowerShell to run its next stage without a visible console.

Malicious Windows Defender Service Tampering via PowerShell (via process_creation)

This rule detects PowerShell stopping or disabling the WinDefend service. The AgentTesla CPL loader chain uses these commands to neutralize Windows Defender before payload injection.

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly combined with GZip stream decompression. BatLoader uses this in-memory loading pattern to unpack and run RAT payloads such as QuasarRAT and AsyncRAT.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but whose image name is not powershell.exe or powershell_ise.exe. BatLoader copies powershell.exe to a temp folder under a decoy name such as Bill.bat.exe to evade image-based detection.

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

This rule detects PowerShell script content that combines Invoke-Expression with the -replace operator using mixed-case obfuscation, a deobfuscation-then-execute pattern used by GootLoader. Attackers scramble the payload string and reconstruct it at runtime to evade static detection before executing it in memory. The IEX plus -replace combination is a strong indicator of obfuscated in-memory execution.

Suspicious PowerShell Archive Extraction to AppData Roaming

This rule detects PowerShell expanding an archive into the AppData Roaming directory, the delivery step used by the WordPress ClickFix campaign to stage the NetSupport RAT. Extraction of archives into user-writable roaming locations by PowerShell is a common malware staging behavior.

Malicious PowerShell Spawned by Masqueraded NVIDIA GeForce Experience Binary

This rule detects PowerShell spawned by a process named nvidia geforce experience.exe, a masquerade the Genesis Market campaign used to sideload LummaStealer from a legitimately named binary. The genuine GeForce Experience application does not launch PowerShell, so this chain indicates DLL sideloading and stealer execution.

Suspicious PowerShell Hidden Unrestricted Execution via ClickFix

This rule detects PowerShell launched with a hidden window together with an unrestricted execution policy and the no-profile flag, the launch pattern used by the LummaStealer 2.0 ClickFix lure to run its downloader stage. Attackers combine these flags to suppress user visibility and bypass script restrictions, so the combination is a strong signal of scripted malware delivery.

Suspicious PowerShell Spawned by cscript in Script Chain

This rule detects PowerShell being launched by cscript.exe, matching the GootLoader wscript to cscript to PowerShell execution chain. Attackers use this scripted lineage to stage the loader and pull down follow-on payloads while appearing script-driven. A Windows Script Host interpreter spawning PowerShell is a common malware-loader hand-off worth alerting on.

Suspicious PowerShell Download Cradle via ClickFix Fake CAPTCHA (via process_creation)

This rule detects a PowerShell download cradle where Invoke-WebRequest output is piped directly into Invoke-Expression, a pattern used by ClickFix fake CAPTCHA lures to fetch and execute remote script payloads. This exact one-liner is rarely produced by legitimate administration.

Malicious AMSI and ETW Patching via PowerShell Script

This rule detects PowerShell script content that references AmsiScanBuffer or EtwEventWrite in order to patch the Antimalware Scan Interface and Event Tracing for Windows, an in-memory evasion step UAT-11795 performs before injecting the Starland RAT as reported by Cisco Talos. Tampering with these logging and scanning interfaces blinds defenses. Detecting the patch strings exposes active defense evasion in the loader.

Suspicious PowerShell EncodedCommand Spawned From Command Shell via Process Creation

This rule detects cmd.exe spawning powershell.exe with an encoded command argument as seen in the KongTuke fake-CAPTCHA infection chain reported by Cisco Talos. Encoded PowerShell launched from a shell is used to run an in-memory downloader that pulls a second stage and beacons to attacker infrastructure. Catching this early breaks the chain before payload retrieval and anti-forensic cleanup occur.

Suspicious Script Download via Curl and PowerShell by Dohdoor

This rule detects the curl utility downloading a batch or command script over HTTP. The Dohdoor campaign uses PowerShell wrapped curl requests to stage follow-on .bat and .cmd payloads. Fetching executable scripts through curl is characteristic of malware staging.

Malicious Mass Hyper-V Virtual Machine Shutdown via PowerShell by Kraken Ransomware

This rule detects PowerShell forcibly stopping Hyper-V virtual machines by piping Get-VM into Stop-VM with the force and turnoff switches. This technique is used by the Kraken ransomware group to shut down virtualized workloads before encryption. Terminating running virtual machines unlocks their files for encryption and maximizes operational impact.

Suspicious PowerShell WebClient DownloadFile of Archive Payload (UAT-7237)

This rule detects PowerShell using the System.Net.WebClient DownloadFile method to retrieve a remote archive payload. UAT-7237 uses this technique to stage tooling including SoftEther VPN packaged as a RAR archive for persistence. Scripted downloads of archives via WebClient are a common malware staging behavior.