Sigma detection rules, expert-reviewed

Suspicious schtasks Persistence Spawned from PowerShell or Script Chain

This rule detects schtasks creating a scheduled task when launched from a PowerShell or command-shell parent, a persistence step observed in the Suky Castle ClickFix-style campaign where an obfuscated PowerShell to cmd to attrib to schtasks chain established persistence. It captures scheduled-task creation originating from an interactive scripting context rather than an installer. Detecting this is important because attacker-driven schtasks activity typically descends from a script host rather than a legitimate management tool.

Suspicious PowerShell Execution Referencing an AppData Path

This rule detects powershell.exe executing a command that references a user AppData path, a persistence pattern in which scheduled tasks or autoruns launch PowerShell payloads staged in AppData. This behavior helps hunt for script-based persistence that survives reboots.

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

This rule detects PowerShell script content invoking bulk Active Directory enumeration cmdlets such as Get-ADComputer or Get-ADObject that query the directory over Active Directory Web Services. Threat actors route enumeration through ADWS on port 9389 to avoid classic LDAP monitoring, so wide directory queries via these cmdlets indicate reconnaissance of domain assets and delegation.

Malicious PowerShell In-Memory Download Cradle via IEX DownloadString

This rule detects PowerShell invoking IEX together with a Net.WebClient DownloadString call to fetch and execute code directly in memory. This tradecraft was used by APT41 to stage ShadowPad and Cobalt Strike against a Taiwanese government-affiliated research institute. In-memory download cradles let attackers run remote payloads without writing them to disk which frustrates file-based detection.

Suspicious RevengeHotels JS Loader Spawning PowerShell (via process_creation)

This rule detects wscript executing a Fat named JavaScript file that then launches PowerShell as used in the RevengeHotels campaign to stage VenomRAT. The threat actor delivers phishing JS droppers whose PowerShell child fetches the remote access trojan. A script host running a Fat JS file with a PowerShell descendant is a strong sign of this loader chain.

Suspicious FileFix TypedPaths Entry Containing PowerShell or URL

This rule detects an Explorer TypedPaths registry value that records a PowerShell command or HTTP URL, the forensic artifact left when a FileFix lure has the victim paste an obfuscated command into the File Explorer address bar. TypedPaths normally stores browsed folder locations, not scripts or web addresses. A command string or URL in this value indicates the FileFix address-bar execution technique.

Suspicious PowerShell Stager Download of Spf Script by Seedworm

This rule detects PowerShell referencing the Spf.ps1 stager under a remote install path used by the Seedworm MuddyWater actor. The script initiates the next stage of the intrusion against Middle East targets. PowerShell fetching a remote install script is a common first-stage execution technique.

Suspicious PowerShell AMSI Bypass In-Memory Patching

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by reflectively locating and patching amsiInitFailed or amsi.dll in memory. The ARECHCLIENT2 information stealer uses this AMSI bypass so subsequent in-memory stages are not inspected by endpoint scanning.

Suspicious Windows Subsystem for Linux (WSL) Installation - PowerShell (via powershell)

This rule detects enables the WSL to cary out malicious activities in a virtual instance to avoid detection.

Suspicious Microsoft Defender Exclusion Added via PowerShell

This rule detects PowerShell adding a Microsoft Defender exclusion path, a defense-evasion step performed by Pure Crypter before deploying its payload. Attackers exclude their staging directories from antivirus scanning so subsequent malicious files execute undetected, making unexpected Add-MpPreference exclusions a reliable evasion indicator.

Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)

This rule detects the GootBot implant using the PowerShell Start-Job cmdlet to run base64-decoded payloads in background jobs, evading child-process monitoring. The pairing of Start-Job with a FromBase64String call inside a scriptblock is a strong indicator of in-memory loader activity. Routine administrative scripts seldom combine these.

Suspicious PowerShell Download Cradle Using irm and iex via Interlock Loader (via process_creation)

This rule detects the MintLoader stage of Interlock intrusions which runs PowerShell with a hidden window and pipes an Invoke-RestMethod download directly into Invoke-Expression. This irm to iex pattern fetches and executes remote code in memory. It is a common but high signal initial access technique for this actor.

Suspicious Curl Download to Windows Temp via PowerShell (via process_creation)

This rule detects PowerShell invoking curl with follow-redirect to download a payload into the Windows Temp directory, a staging step in the SILENTCONNECT campaign delivering ScreenConnect. Observed in Elastic Security Labs telemetry where an execution-policy-bypassed PowerShell retrieves the next-stage installer for remote access.

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

This rule detects call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.