Sigma detection rules, expert-reviewed

Suspicious PowerShell ReadAllBytes and Expand-Archive Payload Staging (via process_creation)

This rule detects PowerShell reading raw bytes from a dropped file and expanding an archive in the same command, a loader chain launched from a malicious LNK in the SmugX campaign delivering PlugX. Chaining ReadAllBytes with Expand-Archive is characteristic of staged payload extraction rather than normal scripting.

In-Memory Offensive PowerShell Tooling Cmdlet Usage (via process_creation)

This rule detects command lines that reference offensive PowerShell tradecraft such as Invoke-Mimikatz, PowerView, Invoke-Kerberoast or Get-Keystrokes, revealing use of red-team frameworks for credential access, discovery and post-exploitation. Weaponized PowerShell is the most prevalent technique in the Red Canary Threat Detection Report, and these function names are strong indicators of adversary tooling loaded in memory. Detecting the cmdlet names surfaces the activity even when the payload is fileless.

Suspicious KeePass Configuration Discovery via PowerShell Script

This rule detects execution of the Find-KeePassConfig PowerShell function, used by the ransomware actor Storm-0501 to locate KeePass password database configuration files for credential theft. Discovering KeePass configs is a precursor to extracting master keys and stored secrets from password vaults.

Malicious Windows Event Log Clearing via PowerShell

This rule detects Windows event log clearing performed through PowerShell log-management methods, an anti-forensic action Qilin ransomware used to wipe event logs during its intrusion. Programmatic clearing of event logs is rarely legitimate and typically indicates an adversary covering tracks.

Suspicious PowerShell Get-Content Piped to PowerShell (via process_creation)

This rule detects PowerShell reading a file with Get-Content and piping the result through Out-String into another PowerShell instance. The STEADY#URSA campaign used this pattern to execute the covert SUBTLE-PAWS backdoor stager.

Malicious AMSI Bypass via PowerShell amsiInitFailed Patch

This rule detects PowerShell reflection that flips the AMSI amsiInitFailed field to disable in-memory script scanning. Fake browser update chains delivering BitRAT and Lumma Stealer used this to blind AMSI before reflective .NET loading. Disabling AMSI removes a primary defense against staged malicious payloads.

Suspicious Level.io RMM Silent Install via PowerShell (via ps_script)

This rule detects a PowerShell one-liner pulling the Level.io RMM installer from downloads.level.io, abused as unauthorized remote access tooling during a ransomware precursor intrusion. Threat actors deploy Level.io alongside Cobalt Strike on a unified command-and-control channel to retain persistent control. Unexpected RMM installation is a strong sign of adversary tradecraft.

Malicious Hidden PowerShell Execution From PerfLogs via Process Creation

This rule detects PowerShell launched with a hidden window that references an executable under the PerfLogs directory. The DroxiDat and SystemBC intrusion staged payloads such as hos.exe in C:\perflogs and executed them through hidden PowerShell, a technique used to run malware from an unusual location while suppressing any visible window.

Malicious Payload Downloaded via PowerShell (via powershell)

This rule detects download a payload using PowerShell.

Suspicious Hidden PowerShell Download Cradle via IEX (via process_creation)

This rule detects a hidden-window PowerShell process using a download cradle and IEX to execute remote content in memory. Amatera Stealer ClickFix lures pasted this pattern to pull and run the next stage.

RedDelta MSI Installation via Hidden PowerShell WindowsInstaller COM Object (via process_creation)

This rule detects the RedDelta delivery command that drives a hidden PowerShell process to instantiate the WindowsInstaller COM object and silently install a remote MSI with REMOVE=ALL. Adversaries leverage the scripted installer COM interface to fetch and run payloads while suppressing the installer UI, making this command pattern a strong execution indicator.

Suspicious Hidden Window PowerShell with Modified Execution Policy (via process_creation)

This rule detects PowerShell launched with a hidden window and a bypassed or relaxed execution policy in a single command line. DragonForce and many ransomware loaders use this combination to run staging scripts silently, evading user awareness and default script-execution restrictions.

Malicious DeceptiveDevelopment Defender Exclusion for Coin Miner via PowerShell

This rule detects PowerShell adding Microsoft Defender exclusions for cryptomining components used by the DeceptiveDevelopment cluster after a ClickFix fake-interview lure. Attackers whitelist TsunamiClient and XMRig paths so the dropped miners run undetected, and matching this behavior surfaces active defense evasion before mining begins.

Suspicious Hidden Encoded PowerShell Launching Node.js Runtime

This rule detects PowerShell invoked with hidden window style and an encoded command that launches node.exe, a loader chain used by the Tsundere Node.js botnet. The malware uses powershell -WindowStyle Hidden -NoLogo -enc to decode and start its Node.js payload out of sight. Combining hidden execution and base64 encoding to bootstrap a Node runtime is a strong indicator of malicious loader activity.

Enable WDigest using PowerShell (ps_module)

Rule to detect registry modifications to enable WDigest using powershell script modules.