Sigma detection rules, expert-reviewed

Suspicious PowerShell AMSI or ETW Tampering

This rule detects PowerShell script content that patches or disables the Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW), a defense-evasion technique used to blind in-memory scanning and telemetry before executing malicious payloads. Such tampering is a hallmark of offensive tooling that seeks to run undetected in memory.

Suspicious Batch Fake Installer Spawning PowerShell Downloader via OXLoader

This rule detects a batch script masquerading as an installer that spawns PowerShell to download a remote executable as used by the OXLoader loader chain delivering CASTLESTEALER in Elastic research. A cmd hosted bat launching PowerShell with a download command is an early stage indicator of the fake installer social engineering lure.

Malicious Renamed PowerShell as wt.exe in ProgramData via Axios Compromise

This rule detects a PowerShell binary renamed to wt.exe and executed from the ProgramData directory as seen in the Axios npm supply chain compromise. The RAT masquerades its interpreter to evade process name based detection and blend with Windows Terminal, enabling stealthy execution of downloaded payloads.

Suspicious ClickFix PowerShell Execution with Hidden Window (via process_creation)

This rule detects PowerShell launched with an abbreviated hidden window style argument combined with string reconstruction, a pattern used by ClickFix clipboard lures delivering MIMICRAT. Observed in Elastic Security Labs telemetry where powershell -WInDo Min hides the console while string-slicing rebuilds the attacker domain to fetch the custom RAT.

Suspicious Encoded PowerShell Execution with No Profile

This rule detects PowerShell launched with the -noprofile flag alongside an encoded command argument, the launcher pattern seen delivering the FORMBOOK payload dllhostSvc.exe. Combining profile suppression with base64-encoded commands is a common obfuscation used to hide the downloaded second stage.

Suspicious PowerShell Encoded Command Execution

This rule detects powershell.exe or pwsh.exe invoked with an encoded command parameter, a technique used to obfuscate scripts and command-and-control instructions during post-exploitation and exfiltration. Encoded commands hide intent from casual inspection and are frequently abused by malware and offensive frameworks.

Suspicious PowerShell BITS Transfer of DLL Payload via process_creation

This rule detects PowerShell using the BITS transfer cmdlet to download a DLL payload, matching the WARMCOOKIE backdoor delivery chain initiated from a malicious JavaScript file. The technique leverages the background intelligent transfer service to retrieve the loader while evading some download monitoring. A DLL fetched by Start-BitsTransfer through PowerShell is highly suspicious.

Malicious Masquerading TiWorker Spawning PowerShell Downloader via process_creation

This rule detects a masquerading TiWorker.exe process spawning PowerShell to fetch a remotely hosted payload disguised as a PNG image, matching the GHOSTENGINE crypto mining infection chain. The legitimate TiWorker.exe is a Windows Modules Installer worker and does not normally launch PowerShell download activity. This behavior indicates process masquerading for initial payload retrieval.

Suspicious Script Host Spawning PowerShell via Process Creation

This rule detects the Windows script host wscript or cscript launching PowerShell which mirrors the PIKABOT delivery chain where an obfuscated JavaScript file spawns PowerShell to download the loader. This parent child relationship is a frequent indicator of scripted phishing payloads executing.

Suspicious PIKABOT PowerShell Download to Public Directory via Process Creation

This rule detects PowerShell using Invoke-WebRequest to download an executable into the public users directory which is the delivery step of the PIKABOT infection chain after an obfuscated script launches PowerShell. Fetching a payload directly into a world-writable path is a common malware staging behavior.

Suspicious PowerShell Script Fetching Remote Batch File From Paste Site (via ps_script)

This rule detects PowerShell script blocks that reference a paste site alongside a batch file extension, matching the download-and-execute behavior in Deep Instinct's Regex Gone Rogue analysis. The macro-launched PowerShell retrieves and runs a .bat file hosted on Pastebin. This indicates staged remote payload delivery and execution through a living-off-the-land interpreter.

Suspicious PowerShell Download of Payload From Pastebin (via process_creation)

This rule detects PowerShell invoked with a command line referencing pastebin.com, the delivery channel described in Deep Instinct's Regex Gone Rogue analysis where an Excel macro fetches a batch payload from Pastebin. Attackers stage second-stage scripts on paste sites to evade domain reputation controls. This indicates remote payload retrieval during the execution stage.

Suspicious PowerShell Interaction with ProgramData SysInt Log via Process Creation

This rule detects PowerShell reading or writing the C ProgramData SysInt.log file that MuddyWater's DarkBeatC2 uses as a staging and command buffer in its multi-stage poll loop. The specific ProgramData filename combined with PowerShell indicates the DarkBeatC2 implant rather than legitimate logging.

Suspicious PowerShell Remote Download and Execution via Invoke-WebRequest

This rule detects a PowerShell command that downloads a file with Invoke-WebRequest and then runs it with Start-Process which the MUT-8694 campaign chains inside malicious npm and PyPI packages to fetch and launch a second stage on Windows hosts.

Malicious Microsoft Defender Tampering via PowerShell Preference Cmdlets

This rule detects the use of Add-MpPreference or Set-MpPreference to add scan exclusions or disable real time protection which the MUT-8694 npm and PyPI campaign runs to blind Microsoft Defender before deploying its payloads on Windows developer systems.