Sigma detection rules, expert-reviewed

Suspicious PowerShell Reverse-HTTP Shellcode Download via CVE-2024-4577 Exploitation

This rule detects PowerShell processes that download a payload.ps1 stager delivering reverse-HTTP shellcode from an external command-and-control host. The behavior follows exploitation of the PHP-CGI argument injection vulnerability CVE-2024-4577 on Windows servers seen in a broad mass-exploitation campaign. Attackers use it to gain remote code execution and deploy Cobalt Strike beacons for persistent access.

Suspicious Obfuscated Hidden PowerShell with Encoded Command

This rule detects PowerShell launched with hidden window, no-profile, and no-logo flags together with an encoded or Base64 command argument, an execution pattern observed in a nation-state APT campaign delivering XenoRAT through LNK files that decoded a randomly named script. It captures concealed and encoded script execution used to run in-memory payloads. Detecting this is important because the combination of hidden execution and encoded commands is a strong indicator of obfuscated malicious PowerShell.

Suspicious Hidden PowerShell Launched by Batch Script

This rule detects a batch script spawning PowerShell with hidden and minimized window options, an execution pattern observed in a K-Messenger abuse campaign delivering RoKRAT where a lexus.bat file invoked PowerShell with -windowstyle hidden and -min to run fileless payload stages. It captures concealed script execution originating from a batch launcher. Detecting this is important because hidden PowerShell descending from a batch file is a frequent fileless malware loading technique.

Suspicious PowerShell String Concatenation Obfuscation for Batch Extension via LNK (via process_creation)

This rule detects PowerShell command lines that split the "bat" extension into concatenated string fragments to evade static detection, a technique observed in the APT37 ToyBox Story campaign delivering RoKRAT via malicious LNK files. It captures the obfuscation used to reconstruct a batch loader name at runtime so that command inspection does not reveal the dropped payload. Detecting this hidden concatenation surfaces the initial LNK-driven execution stage before the staged loaders run.

Suspicious PowerShell Spawned by WScript With Hidden Bypass via PureLogs Loader (via process_creation)

This rule detects the PureLogs phishing chain in which a malicious JavaScript file executed by wscript.exe spawns PowerShell with an execution policy bypass and a hidden window to run a dropped script from a temp folder. This parent child relationship between the script host and PowerShell is a strong loader signal. The staged script then hollows a .NET binary.

Suspicious PowerShell Execution of TrainedDataStore Script

This rule detects PowerShell executing a script named TrainedDataStore.ps1, associated with the P.S. Olala tooling used by the BladedFeline group. Execution of this specifically named script indicates attacker PowerShell tradecraft used for command execution and post-compromise activity.

Suspicious Archive Expansion into Public User Directory via PowerShell (via ps_script)

This rule detects PowerShell Expand-Archive activity that extracts content into the C users Public directory, a world-writable staging location abused by the AsyncRAT infostealer chain. Combined with the BITS download of the original archive this reveals payload unpacking prior to execution. Legitimate software rarely unpacks archives into the Public profile.

Suspicious PowerShell .NET Extraction from JPG with Base64 Marker

This rule detects PowerShell reading a jpg image and carving an embedded payload delimited by a base64 start marker. Ande Loader hid an AES encrypted .NET assembly inside a new image jpg between BASE64_START markers before hollowing AddInProcess32. Extracting executable code from an image file this way is a steganography style loader technique.

Suspicious ClickFix PowerShell Download Cradle via TAG-150 Tradecraft

This rule detects a PowerShell download cradle that pipes a fetched script directly into Invoke-Expression using the wget alias. TAG-150 delivers its Griffin20 loader through this ClickFix one-liner that pulls and runs the next stage in memory. In-memory execution of a downloaded script is a strong indicator of fileless staging.

Malicious PowerShell Base64 Exfiltration to save.php via EKZ Stealer

This rule detects PowerShell posting data with UploadString to a save.php endpoint, the exfiltration channel used by the EKZ Stealer following Fortinet exploitation. Base64-encoded stolen data including credentials is sent to the attacker web handler. Outbound UploadString calls to a save.php target strongly indicate data theft over the C2 channel.

Malicious PowerShell Download of FortiEndpoint Patch Masquerade via EKZ Stealer

This rule detects PowerShell using WebClient DownloadFile to retrieve a payload named FortiEndpoint_Patch.exe into ProgramData. This masquerade is used after exploitation of Fortinet CVE-2026-35616 to stage the EKZ Stealer while posing as a security patch. Downloading a fake endpoint patch via PowerShell indicates active post-exploitation tooling.

Suspicious Delayed Expansion Command Obfuscation Building PowerShell via Amatera Stealer

This rule detects cmd.exe using delayed variable expansion to concatenate fragmented strings that reassemble the word powershell at runtime. The Amatera Stealer 4.0.2 loader splits pow and ershell across set commands to defeat static string matching before invoking an encoded PowerShell stage. This command-line obfuscation is a strong indicator of staged stealer execution.

Suspicious PowerShell Host and Locale Reconnaissance via MuddyWater Tsundere Botnet

This rule detects PowerShell enumerating the video controller hardware together with the installed UI culture in a single command. This combined host and locale fingerprinting is used by the MuddyWater Tsundere botnet to profile victims and filter sandboxes before staging its Ethereum-based command and control. Such reconnaissance precedes payload delivery and warrants investigation.

Suspicious node.exe Spawning PowerShell Get-Clipboard

This rule detects a Node.js process spawning PowerShell to run Get-Clipboard, the clipboard-theft behavior of the North Korean DEV#POPPER RAT. The malware, launched from a weaponized developer repository, harvested clipboard contents to steal secrets and seed phrases. A node.exe parent invoking Get-Clipboard is a strong indicator of the DEV#POPPER collection stage.

Malicious PowerShell StreamReader WebRequest Download Cradle

This rule detects PowerShell constructing an IO.StreamReader over a Net.WebRequest response stream and executing it, the fileless NetSupport RAT ClickFix cradle. The loader used this in-memory download-and-execute technique to pull its next stage without writing a script to disk. Reflective download cradles built from StreamReader and WebRequest are almost exclusively malicious.