Sigma detection rules, expert-reviewed

Suspicious PowerShell UTF8 OutputEncoding Command Wrapper

This rule detects PowerShell command lines that set OutputEncoding to a UTF8 encoding object before running an inline command, the wrapper ChaosBot used for every shell command it executed. The Rust bot prefixed all remote commands with this OutputEncoding assignment to reliably capture and exfiltrate output over Discord. While some scripts set encoding, this exact inline pattern combined with remote command execution is suspicious.

Malicious PowerShell Clipboard Script Execution via ScriptBlock Create

This rule detects PowerShell reading the clipboard and executing it through ScriptBlock Create, the core of the Interlock ClickFix lure. Victims were tricked into pasting a command that pipes a downloaded payload to the clipboard and then runs Get-Clipboard as a script block. This clipboard-to-execution pattern lets attackers gain code execution while hiding the real command from the user.

Malicious ClickFix MSI Download and Execution via PowerShell

This rule detects PowerShell using curl to download an MSI installer to disk, the ClickFix delivery chain used to stage DeerStealer. Victims are socially engineered into pasting a Run-dialog command that fetches and installs a malicious package, so a scripted curl download of an .msi followed by installation is a high-fidelity infection indicator.

Suspicious Active Directory Enumeration via PowerShell DirectorySearcher

This rule detects PowerShell using the DirectoryServices DirectorySearcher class to enumerate Active Directory objects, a domain reconnaissance technique used by RansomHub affiliates. Scripted LDAP searching through DirectorySearcher is rarely performed by ordinary users and commonly precedes lateral movement and privilege escalation.

Suspicious PowerShell Download Cradle via Net.WebClient DownloadFile

This rule detects PowerShell invoking the Net.WebClient DownloadFile method, a download cradle used by KoiLoader shortcut droppers to retrieve secondary payloads. Scripted retrieval of remote files through the .NET web client is a common ingress technique for loaders and should be reviewed in context.

Suspicious Script Host Launching PowerShell from Fattura Named JScript File (via process_creation)

This rule detects wscript or cscript executing a JScript file using the Fattura naming convention and then spawning PowerShell, the first stage of the MintsLoader delivery chain. The Italian themed Fattura invoice lure drops a .js file that calls WScript Shell Run to launch an obfuscated PowerShell downloader. This script host to PowerShell handoff from an invoice named file marks the loader kickoff.

Suspicious PowerShell Spawned from PyInstaller MEI Extraction Folder (via process_creation)

This rule detects powershell.exe spawned by a process running from a PyInstaller _MEI extraction folder under the user Temp directory, matching SolarMarker's shift to PyInstaller-packed loaders. The bundled Python script decodes base64 and invokes PowerShell with a hidden window, so a PowerShell child of a _MEI process is anomalous. This stages the SolarMarker backdoor.

Suspicious Script Host Spawning PowerShell from Fake Browser Update JS

This rule detects wscript or cscript executing a JScript file and spawning PowerShell, the delivery chain used by SmartApeSG fake browser update lures to pull a base64 encoded NetSupport payload. A JavaScript file launching PowerShell is a strong sign of a drive by download rather than legitimate scripting.

Malicious Run Key Persistence Pointing to Renamed PowerShell via Axios Compromise

This rule detects a CurrentVersion Run key value whose data references the renamed wt.exe interpreter or a script staged in ProgramData or TEMP as used by the Axios supply chain RAT for persistence. Attackers register the masqueraded PowerShell to re establish the implant at logon, ensuring durable access to the compromised host.

Suspicious PowerShell Persistence via Registry Run Key

This rule detects creation of a Run key value that launches PowerShell at user logon, matching the RegistryPersistence Beacon Object File demonstrated in Elastic testing of Cobalt Strike detection gaps. Adversaries write a PowerShell payload to the CurrentVersion Run key so their implant re-executes on every startup. A Run entry that invokes PowerShell is a common autostart persistence pattern worth reviewing.

Suspicious PowerShell WMI Video Controller Sandbox Evasion Check via OXLoader

This rule detects PowerShell querying the WMI Win32 VideoController class to inspect display refresh rate as a sandbox and virtualization check used by the OXLoader loader in Elastic research. Malware probes video controller properties to detect analysis environments before deploying the CASTLESTEALER payload, so this query in a script block signals evasion logic.

Suspicious PowerShell Outlook COM Automation for Mail Access via TCLBANKER

This rule detects PowerShell attaching to a running Outlook instance through the COM automation interface as used by the TCLBANKER trojan to read victim mail in Elastic research. Using GetActiveObject on the Outlook Application object allows the malware to harvest messages and monitor the inbox for banking interactions.

Suspicious PowerShell Remote Download of PhantomPulse Stager

This rule detects PowerShell using Invoke WebRequest or Start BitsTransfer to retrieve the PhantomPulse stager scripts and syncobs executable documented in Elastic research on Obsidian abuse. Fetching a remote first stage over web requests inside a script block indicates the loader phase of the RAT infection.

Malicious DYNOWIPER PowerShell Loader Execution (via ps_script)

This rule detects execution of the DYNOWIPER PowerShell loader scripts that stage and launch the destructive wiper against Poland's energy sector. Observed in Elastic Security Labs telemetry where dynacon_update.ps1 or exp.ps1 orchestrate dropping and running the wiper binary, indicating imminent data destruction.

Malicious ClickFix Clipboard Command Execution via PowerShell

This rule detects PowerShell command lines that download remote content with Invoke-WebRequest and immediately pipe it into Invoke-Expression, a pattern used by ClickFix social-engineering lures. This tradecraft was observed delivering GHOSTPULSE and the ARECHCLIENT2 information stealer, where victims are tricked into pasting a clipboard command into the Run dialog to fetch and run a next-stage payload in memory.