Sigma detection rules, expert-reviewed

Malicious Microsoft Defender Whole-Drive Exclusion via PowerShell

This rule detects PowerShell adding the entire system drive as a Microsoft Defender exclusion path, an aggressive defense-evasion action used by Cyber Stealer to blind antivirus across the whole host. Excluding C drive from scanning is almost never legitimate and effectively disables Defender file protection, making this a high-confidence evasion indicator.

Malicious Kimsuky Keylogger PowerShell Functions PokDoc and InfoKey (via ps_script)

This rule detects PowerShell script content containing the PokDoc and InfoKey function names used by the Kimsuky implant observed against Japanese organizations. These function names are implant-specific keylogging and document-collection routines, so their presence in scriptblock logs indicates hands-on infostealer activity.

Malicious DPAPI Credential Decryption via PowerShell ProtectedData Unprotect

This rule detects PowerShell invoking the DPAPI ProtectedData Unprotect method to decrypt secrets from the current user context. SocGholish operators used this to unprotect stolen browser credential material after staging it locally. This lets attackers recover plaintext passwords without touching disk artifacts that alert defenders.

Malicious ClickFix PowerShell IEX DownloadString Execution

This rule detects PowerShell running with no-profile and bypass execution policy while using DownloadString and IEX to fetch and run a remote payload, the EVALUSION ClickFix loader. Victims were social-engineered into executing this command which pulled Amatera Stealer and NetSupport RAT from attacker infrastructure. The combination of policy bypass and an in-memory download cradle is a high-confidence execution indicator.

Suspicious Curl POST Downloading PowerShell Payload to Temp Directory (via process_creation)

This rule detects curl issuing an HTTP POST request whose output is a PowerShell script, the ingress technique used in the Axios NPM supply chain attack where cmd.exe piped a curl POST response into a .ps1 file in the Temp directory. Adversaries stage second-stage scripts this way to pull payloads from attacker infrastructure, so the combination of curl, a POST verb, and a PowerShell target file is worth alerting on.

PowerShell In-Memory Shellcode Execution via Memory Allocation APIs (via ps_script)

This rule detects a PowerShell script block that combines GlobalAlloc VirtualProtect and CreateThread calls to allocate executable memory and run shellcode, the in-memory loading behavior of the RokRAT search.dat loader read from the public directory. Adversaries leverage reflective shellcode execution to run their payload without touching disk as a file, making early detection critical for surfacing fileless code execution before RokRAT deploys.

Suspicious PowerShell Invoke-WebRequest and Invoke-Expression Download Cradle via ClickFix

This rule detects PowerShell combining Invoke-WebRequest with Invoke-Expression to download and execute a payload in memory as seen in the ClickFix Revenge of detection campaign. This download cradle avoids writing the payload to disk and is triggered from a pasted Run dialog command. The pairing of remote fetch and dynamic execution is a strong malicious signal.

Suspicious PowerShell Download of scrss or ekrn Masquerading Scripts

This rule detects PowerShell referencing scrss.ps1 or ekrn.ps1, downloader script names used in the Gamaredon and Turla collaboration to fetch and stage further payloads. The script names imitate the legitimate csrss and ESET ekrn processes, and their presence in PowerShell activity indicates masqueraded ingress tooling and command execution.

Suspicious Encoded PowerShell Command Execution (via process_creation)

This rule detects PowerShell invoked with an encoded command payload passed through the EncodedCommand parameter. Adversaries base64-encode PowerShell to obscure their commands from casual inspection and simple content filters. While some administrative tooling encodes commands, encoded PowerShell on user endpoints is a frequent execution and obfuscation indicator worth reviewing.

Suspicious PowerShell Remote Script Execution From GitHub via irm and iex (via process_creation)

This rule detects the multi stage Windows campaign loader running PowerShell that pipes an Invoke-RestMethod download of a raw GitHub hosted script into Invoke-Expression for fileless execution. Fetching and executing raw GitHub content in memory is a hallmark of the initial loader. Later stages disable Defender and deploy a RAT and ransomware.

Suspicious PowerShell WebClient DownloadFile with Execution Policy Bypass (via process_creation)

This rule detects PowerShell launched with an execution policy bypass and a hidden window that instantiates Net.WebClient to call DownloadFile. This behavior was observed in the updated MATA campaign against industrial companies to stage additional payloads onto compromised hosts. Detecting this scripted download surfaces the ingress-tool-transfer stage of the intrusion.

Suspicious PowerShell Download to Public Libraries Folder (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download payloads into the Public Libraries staging directory. This behavior was observed in the MULTI#STORM campaign delivering Warzone and Quasar RAT payloads.

Malicious TELEPUZ ClickFix Stager via Hidden PowerShell Grab Endpoint

This rule detects a hidden execution-policy-bypass PowerShell command that pulls a payload from an index.php grab endpoint which is the ClickFix stager of the TELEPUZ malware-as-a-service delivered through Vidar chains. Victims are lured into pasting the command from a fake verification prompt. The specific grab API path combined with bypass flags marks the malicious download.

VSS Backup Deletion via WMI - Powershell (via powershell)

This rule detects delete existing VSS backup via WMI.

Malicious Windows Defender Real-Time Monitoring Disabled via PowerShell

This rule detects use of Set-MpPreference to disable Windows Defender real-time monitoring. In the WithSecure Catching Lazarus research the actor turns off real-time protection before dropping and running further tooling. Attackers disable defensive agents to run payloads without antivirus detection.