Sigma detection rules, expert-reviewed

Suspicious PowerShell Download From catbox.moe (via process_creation)

This rule detects PowerShell referencing the catbox.moe file-sharing service, abused in the Cascading Shadows campaign to deliver later stages of a multi-step loader chain. Retrieving payloads from this public host lets the attacker stage malware while blending with legitimate file-sharing traffic.

Suspicious Hidden PowerShell Retrieving VBScript from mcdir.me by Millenium RAT (via process_creation)

This rule detects hidden PowerShell fetching a VBScript stager from the mcdir.me delivery host used in the Millenium RAT malware-as-a-service infection chain launched from a malicious LNK. The script downloads and runs the next-stage executable while showing the victim a decoy PDF. Detecting the download cradle interrupts the RAT installation early.

Malicious UAT-8302 Hidden PowerShell Execution of whatpc.ps1

This rule detects PowerShell running the whatpc.ps1 script with an execution policy bypass and a hidden window, matching the UAT-8302 reconnaissance stager. The named script drives host profiling and follow-on tasking while the hidden bypass flags suppress user visibility and controls. Execution of this specific script under these flags indicates active UAT-8302 operations.

Suspicious Download to Windows appcompat Directory via PowerShell

This rule detects PowerShell using Invoke-WebRequest to write an executable into the Windows appcompat directory as observed after Triofox CVE-2025-12480 exploitation. Attackers stage payloads such as SAgentInstaller.exe in unusual system paths to evade attention.

Suspicious PowerShell Query of MSHTA Application Class in PEAKLIGHT Chain (via ps_script)

This rule detects PowerShell reading the registry Applications key for mshta under the software classes hive using wildcarded paths, a lookup PEAKLIGHT performs to locate mshta for proxy execution. Programmatic resolution of the mshta binary path is an anti-analysis and living-off-the-land staging behavior.

Suspicious IIS Worker Process Spawning Encoded PowerShell via CentreStack Exploitation

This rule detects an IIS worker process spawning cmd or PowerShell that runs base64 encoded payloads, behavior observed during active exploitation of Gladinet CentreStack and Triofox local file inclusion flaws. Attackers leverage the web application context to achieve remote code execution and stage further tooling. Web servers rarely spawn encoded interpreters, so this indicates likely post-exploitation activity.

Suspicious SharePoint w3wp Spawning Encoded PowerShell (ToolShell Exploitation)

This rule detects the SharePoint IIS worker w3wp spawning PowerShell with an encoded command, the post exploitation activity following ToolShell webshell deployment. It matters because encoded PowerShell launched by the web server process indicates server side code execution and obfuscated attacker commands.

Suspicious Windows Terminal Launching Hidden PowerShell with Execution Bypass (via process_creation)

This rule detects Windows Terminal (wt.exe) launching a hidden PowerShell instance with an execution policy bypass and a script file argument, a chain observed in the North Korea-nexus compromise of the Axios NPM package where a postinstall script dropped and ran a PowerShell payload. Adversaries use this to execute code stealthily while bypassing script controls, which makes it valuable for catching supply-chain-driven execution.

Malicious FortiClient Process Spawning PowerShell Downloader (via process_creation)

This rule detects the FortiClient fortitray.exe or ipsec.exe process spawning a command shell or PowerShell. Exploitation of CVE-2026-35616 in FortiClient EMS delivered the EKZ infostealer through this process chain disguised as a Fortinet endpoint patch.

Suspicious Edge Update Setup Spawning PowerShell via ClearFake

This rule detects a MicrosoftEdgeUpdateSetup lure executable spawning PowerShell. The ClearFake fake-update campaign delivers a spoofed Edge updater that launches PowerShell to fetch and run its next stage, an execution chain that legitimate browser updates do not produce.

Suspicious PowerShell Execution of Script from Netlogon Share by Cyber Anarchy Squad

This rule detects PowerShell launched with an execution policy bypass to run a script hosted on the domain netlogon share. The Cyber Anarchy Squad uses this technique to distribute and execute tooling such as rm.ps1 across compromised environments. Bypassing execution policy to run a remote logon-share script indicates malicious lateral distribution.

Suspicious CasPol Execution Spawned by PowerShell for Injection

This rule detects the .NET CasPol.exe utility being launched by PowerShell, a system binary proxy execution chain used by the XWorm LATAM campaign to hollow CasPol and host the RAT payload. CasPol is seldom executed interactively, and a PowerShell parent is highly suspicious.

Suspicious Windows Defender Exclusion for PowerShell via Add-MpPreference (via process_creation)

This rule detects the AsyncRAT loader disabling Microsoft Defender coverage by adding process and path exclusions through Add-MpPreference. The campaign excludes the entire C drive and the powershell.exe process to protect its staged payloads. Adding a scripting host as a Defender exclusion is rarely legitimate.

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

This rule detects a process whose original file name is PowerShell but which executes under the wt.exe Windows Terminal file name. The axios supply chain payload renamed powershell.exe to wt.exe to evade name-based detection, so a mismatch between the internal PowerShell identity and a wt.exe image name indicates a masqueraded interpreter.

Suspicious Hidden PowerShell Download Cradle via ClickFix (via process_creation)

This rule detects a hidden window PowerShell process invoking DownloadString to pull a remote second stage, matching the HarborWatch ClickFix chain that runs a base64 command to fetch code from a remote text file. A hidden PowerShell window combined with a web download is a strong indicator of scripted delivery.