Sigma detection rules, expert-reviewed

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.

Malicious PowerShell Download Rename and Execute Chain via Script Block

This rule detects a PowerShell script block that downloads a file into the public directory with Invoke-WebRequest, renames it to an executable with Rename-Item, and launches it with Start-Process. RomCom uses this exact chain after its Firefox and Windows zero-day exploitation to stage and run its backdoor. This indicates scripted payload delivery following exploitation.

Malicious Domain Group Membership Change (via powershell)

This rule detects if a member is added to a domain group via PowerShell.

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning PowerShell or cmd.exe, behavior produced when the GhostRedirector group abuses the xp_cmdshell stored procedure to run operating system commands. A database engine launching a shell indicates SQL-based remote code execution used for downloading tooling and establishing footholds on Windows servers.

Malicious Service Abuse with Malicious ImagePath - Reg via PowerShell (via powershell)

This rule detects modify the original service executable path with a malicious one.

Suspicious PowerShell Download to AppData Intel Path

This rule detects PowerShell using DownloadFile to stage a payload into an AppData Intel directory as seen in the Foxit PDF exploitation chain. The attacker hides downloaded miner and RAT payloads under an Intel named folder in the user profile. Detecting the download cradle exposes remote payload retrieval.

Malicious Microsoft Defender Tampering via PowerShell MpPreference

This rule detects PowerShell disabling Microsoft Defender real-time monitoring or adding scan exclusions, the defense-evasion step performed by The Gentlemen ransomware before deploying its payload. Tampering with Defender protection settings is a high-confidence indicator of an adversary preparing to run malware unhindered.

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

This rule detects PowerShell downloading an archive named updserc.zip into the local AppData directory. This activity is part of a ClickFix phishing chain abusing Booking.com themed lures to stage the PureRAT loader. Pulling a named archive into AppData through PowerShell is an early loader step that precedes DLL side-loading and in-memory execution.

Obfuscated Encoded PowerShell Payload Deployed via Service (via security)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe

This rule detects a PowerShell binary copied to wt.exe under ProgramData and executed with a hidden window and execution policy bypass, matching the Axios NPM supply chain incident where a post-install hook drops a RAT. Renaming powershell.exe to wt.exe masquerades the interpreter as Windows Terminal to evade name-based detection. Execution of a masqueraded interpreter from ProgramData with bypass flags is a strong compromise indicator.

Suspicious Fileless PowerShell Execution via Invoke-RestMethod Piped to IEX (via process_creation)

This rule detects PowerShell fetching remote content with Invoke-RestMethod and piping it straight into Invoke-Expression, the fileless delivery used by the SEO poisoning campaign impersonating Gemini and Claude Code installers. This pattern executes attacker-hosted script without touching disk. Some tooling uses irm iex legitimately, so review the target domain.

Possible PowerShell Empire Default User-Agent In HTTP Traffic

This rule detects outbound HTTP traffic carrying the default user-agent string shipped with the PowerShell Empire C2 framework. In the WithSecure C2 and Exfiltration Lab 1 the Empire agent beacons out with an unmodified Mozilla compatible MSIE user-agent that is characteristic of the framework default profile. Attackers rely on this static header for their staging and command channel unless an operator customizes it.

Malicious Microsoft Defender Threat Exclusion Added - PowerShell (via powershell)

This rule detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities.

Malicious PowerShell DownloadFile to AppData Executable

This rule detects PowerShell using the WebClient DownloadFile method to fetch an executable into the AppData directory. Warzone RAT runs obfuscated PowerShell that downloads gm.exe into %appdata% before establishing persistence and UAC bypass. Downloading executables into AppData via PowerShell DownloadFile is a common malware retrieval and staging behavior.