Sigma detection rules, expert-reviewed

PipeShell Exfiltration Over Named Pipes (via powershell)

This rule detects establishes "PipeShell" connection(s) between a server and client(s) in order to move laterally or exfiltrate data. The server side will trigger "ServerStream" IOCs meanwhile the client side will trigger "ClientStream" IOCs. The rule works based on this condition, where at least 2 hosts need to trigger one of the condition.

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious PowerShell AMSI Bypass via AmsiInitFailed Command Line

This rule detects the amsiInitFailed AMSI-bypass string in a PowerShell command line, a defense-evasion technique used after Citrix Bleed exploitation to disable script scanning before running the LockBit toolkit. Setting amsiInitFailed forces AMSI to skip inspection. Detecting the string exposes an active attempt to blind endpoint script scanning.

Suspicious PowerShell Self-Delete Of Executable via Process Creation

This rule detects PowerShell used to delete an executable in a wait-and-retry loop. Rhysida ransomware removes its own binary after execution using a PowerShell routine that loops on Test-Path and Start-Sleep until the file is gone, eliminating forensic artifacts.

Possible PowerShell Hidden Download Cradle via Process Creation

This rule detects PowerShell launched with hidden window and no-profile flags executing an in-memory download cradle that uses Net.WebClient DownloadString. Observed in NCC Group research on TA505 exploiting the SolarWinds Serv-U vulnerability CVE-2021-35211 for initial access. This technique stages remote payloads directly in memory to evade disk-based detection which makes it a high-value indicator.

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects powershell.exe spawned as a child of wscript.exe or cscript.exe, the wscript to cscript to PowerShell chain characteristic of Gootloader documented by Red Canary. Script hosts rarely need to invoke PowerShell in benign workflows, so this parent-child relationship is a high-confidence signal of staged script-based malware executing its next-stage payload.

Suspicious PowerShell Communication with Dropbox API (via ps_script)

This rule detects PowerShell script content that contacts the Dropbox content API file download endpoint. The DEEP#GOSU campaign abused Dropbox as a staging and exfiltration channel for encrypted payloads and stolen data.

Suspicious PowerShell Bypass Spawned by wscript Script Host

This rule detects wscript spawning PowerShell with an execution policy bypass, the initial handoff in a Huntress-analyzed malspam-to-loader chain that led to an in-memory .NET loader. A script host launching PowerShell with bypass flags reflects a scripted download-and-execute stage rather than normal administration. This parent-child pattern is a common malspam loader behavior.

Suspicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion via Add-MpPreference. The SonicCrypt crypter behind TA585 MonsterV2 deliveries added its payload to Defender exclusions to evade scanning.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - PowerShell (via powershell)

This rule detects change Defender default action to allow any threats.

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

This rule detects PowerShell spawning uncommon .NET framework utilities used as living-off-the-land execution proxies. The Veil#Drop loader cascaded through these binaries as fallback execution paths for its payload.

Mshta Spawning PowerShell or Command Shell

This rule detects mshta.exe spawning powershell.exe or cmd.exe as a child process. YoroTrooper used an HTA to JScript to PowerShell execution chain to run reverse shells and stage further tooling. Mshta launching a scripting interpreter is a classic proxy-execution and living-off-the-land pattern used to evade application controls.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.

Suspicious PowerShell IEX DownloadString In-Memory Execution via process_creation

This rule detects PowerShell that combines Invoke-Expression with the WebClient DownloadString method to fetch and run remote code entirely in memory. Head Mare and Twelve launched PowerShell with an execution policy bypass and hidden window to download and execute scripts including ADRecon. This fileless download and execute pattern is a common intrusion loader technique.

Malicious PowerShell Download From Storjshare With UAC Elevation via OXLoader

This rule detects PowerShell downloading a payload from the storjshare distribution service and relaunching it with RunAs to trigger UAC elevation as used by the OXLoader loader delivering CASTLESTEALER in Elastic research. Combining a remote fetch with an elevation prompt indicates the loader staging its next component with administrative rights.