Sigma detection rules, expert-reviewed

PowerShell Spawned by Headless Conhost (via process_creation)

This rule detects powershell.exe launched as a child of conhost.exe running with the --headless argument, a hidden-console execution pattern used in the PureRAT infection chain to run a covert download command. Adversaries leverage headless conhost to hide interactive console activity from the user, making this uncommon parent-child pairing a useful signal of scripted payload staging.

Suspicious Entra Agent Service Principal Sign-In With PowerShell User Agent via Sign-In Logs

This rule detects a service principal sign-in using a PowerShell user agent against Entra Agent ID identities, a pattern of automated credential misuse where an attacker authenticates as an AI agent through scripted Graph calls. Because assigned agents normally authenticate through their own runtime rather than interactive PowerShell tooling, this user agent on service principal sign-ins indicates hands-on-keyboard abuse of agent credentials.

Malicious Cloud Atlas PowerShell Download Cradle via IEX WebClient (via process_creation)

This rule detects PowerShell combining Invoke-Expression with a Net.WebClient object to fetch and execute remote content, the download cradle used by Cloud Atlas to run its next stage in memory. The technique avoids writing the payload to disk before execution. Detecting the IEX and WebClient combination surfaces staged payload execution.

Suspicious 32-bit PowerShell Executed From SysWOW64 (via process_creation)

This rule detects invocation of the 32-bit PowerShell binary from SysWOW64, a technique GuLoader uses to run shellcode inside a 32-bit host on 64-bit systems. While some legacy tooling calls this path, its use as a malware execution surface makes it worth surfacing for review.

Malicious PowerShell Masquerading as wt.exe in ProgramData via Axios npm Compromise (via process_creation)

This rule detects a PowerShell binary renamed to wt.exe and executed from ProgramData, a masquerading technique used by the malicious postinstall payload delivered through the compromised Axios npm package. Adversaries rename PowerShell to evade name-based detection while running follow-on scripts, so a PowerShell OriginalFileName under a wt.exe in ProgramData is a strong indicator of the supply chain implant.

Suspicious WScript Spawning PowerShell From VBS Loader via wscript.exe (via process_creation)

This rule detects wscript.exe launching powershell.exe, a script host chain used by the Kimsuky campaign against Japanese organizations where a malicious VBS decoded and executed PowerShell payloads. Attackers rely on this living-off-the-land chain to stage keylogging and infostealer functionality while evading direct execution of binaries.

Suspicious PowerShell Downloader Spawned by Batch Script (via process_creation)

This rule detects a batch script spawning PowerShell to download further payloads as seen in the ScarletStealer installation chain where install.bat pulls additional stealer components from an attacker server.

Suspicious PowerShell Spawned by Windows Script Host from HTML Smuggling (via process_creation)

This rule detects PowerShell launched by wscript or cscript, matching the IcedID chain where HTML smuggling dropped a Windows Script File that ran VBScript and then PowerShell. The PowerShell stage downloaded and executed the IcedID loader.

Suspicious PowerShell Reflective Assembly Load Invoking VAI Method (via process_creation)

This rule detects PowerShell reflectively loading a .NET assembly and invoking a method named VAI. This layered loader uses this in-memory technique to execute payloads decoded from steganographic images.

Masquerading Bumblebee Loader MSI Download via PowerShell Invoke-WebRequest and Silent msiexec (via process_creation)

This rule detects a single PowerShell command that uses Invoke-WebRequest to download an MSI installer and then launches msiexec silently, the delivery behavior used by an LNK-triggered Bumblebee loader infection chain masquerading as Nvidia and Midjourney installers. Chaining a remote MSI fetch with a quiet install in one command line is a strong indicator of staged loader delivery before in-memory payload execution.

PowerShell Loader Execution of Skype.ps1 from Public Folder (via process_creation)

This rule detects PowerShell executing a Skype.ps1 loader staged in the C users Public folder, the AsyncRAT delivery behavior observed in campaigns abusing ScreenConnect and open directories. Adversaries leverage the world-writable Public path to stage and run a fileless .NET loader while masquerading as a common application.

Malicious ClickFix PowerShell Launching mshta with Remote URL (via process_creation)

This rule detects the ClickFix initial-access pattern where powershell.exe invokes mshta against a remote URL after a victim pastes a clipboard command through the Run dialog, as documented by Group-IB. Adversaries use this social-engineering chain to fetch and execute an HTA-based downloader, so the powershell-to-mshta URL pattern is a strong entry-point signal.

Malicious Webserver IIS Module Installed - PowerShell (via powershell)

This rule detects deploy an IIS module via PowerShell.

Suspicious IIS Worker Process Spawning Encoded PowerShell via Gladinet Exploitation

This rule detects the IIS worker process w3wp.exe spawning PowerShell with an encoded command argument, a behavior observed during active exploitation of the Gladinet CentreStack and Triofox insecure cryptography vulnerability where ViewState deserialization leads to code execution. Attackers abuse the hardcoded machineKey to forge ViewState payloads that execute PowerShell from the web application context. This chain indicates web-facing remote code execution and should be treated as a likely server compromise.

Suspicious cscript Execution of JavaScript Spawned by PowerShell

This rule detects powershell.exe spawning cscript.exe to run a JavaScript file, the ClickFix execution chain used by EddieStealer in which a pasted PowerShell command launches a downloaded .js loader. This parent-child relationship combined with script-host execution indicates fake-CAPTCHA social-engineering malware delivery.