Sigma detection rules, expert-reviewed

Suspicious PowerShell AMSI Bypass via 8220 Gang Hadooken Loader

This rule detects PowerShell code that patches the Anti-Malware Scan Interface by reflectively accessing amsiInitFailed or the AmsiUtils type to disable in memory scanning. The 8220 gang uses an AMSI bypass before launching its CCleaner64.exe branded loader in the Hadooken campaign. Disabling AMSI is a common precursor to fileless payload execution and rarely appears in benign scripts.

Suspicious Hidden PowerShell Web Download via ClickFix Tactic

This rule detects PowerShell launched with a hidden window and no profile that immediately downloads and starts a remote payload. IClickFix and related WordPress driven ClickFix campaigns trick users into pasting this command from a fake verification prompt. The combination of a hidden window a bypassed profile and an inline web download reflects unattended payload retrieval rather than normal administration.

Suspicious M365 Password Spraying via Azure PowerShell AppId from Quad7 Botnet

This rule detects Microsoft 365 sign-in attempts using the Azure PowerShell application id 1950a258-227b-4e31-a9cf-717495945fc2 against the Microsoft Graph resource identity, the combination the Quad7 botnet relies on for distributed password spraying. The operators relay authentication through compromised SOHO routers to validate stolen credentials at scale. Clustering on this AppId and resource surfaces the brute force activity for review.

Suspicious Script Host Spawning PowerShell Download Cradle (via process_creation)

This rule detects wscript or cscript spawning PowerShell that runs an Invoke-RestMethod download cradle. The Veil#Drop campaign used a JavaScript launcher under the script host to invoke a remote PowerShell loader.

Suspicious PowerShell Download Cradle to Blogspot (via process_creation)

This rule detects a PowerShell command using Invoke-RestMethod to fetch content from a Blogspot URL. The Veil#Drop campaign abused Blogspot as trusted infrastructure to stage and deliver a PowerShell loader for the PureLog stealer.

Suspicious Renamed PowerShell Binary Execution (via process_creation)

This rule detects a process whose original filename is PowerShell but which runs under a different image name. The Dead#Vax campaign executed a renamed PowerShell binary named mbs.exe to evade image based detections.

Suspicious Defender Behavior Monitoring Disable via PowerShell (via process_creation)

This rule detects PowerShell disabling Windows Defender behavior monitoring through Set-MpPreference. The DEEP#DOOR campaign disabled behavior and realtime monitoring to protect its Python backdoor from detection.

Suspicious PowerShell Executing Code from Environment Variable (via process_creation)

This rule detects PowerShell using Invoke-Expression to run code stored in an environment variable. The OBSCURE#BAT campaign staged its malicious PowerShell in a user environment variable and executed it fileless via this pattern.

Suspicious MSBuild Spawned by PowerShell (via process_creation)

This rule detects the .NET build engine MSBuild.exe being spawned as a child of PowerShell, a living-off-the-land pattern used to execute code outside normal build workflows. The SHADOW#REACTOR campaign abused MSBuild to run an in-memory Remcos payload.

Suspicious Rename of Double-Extension PowerShell Script (via process_creation)

This rule detects a command shell renaming a file with a ps12x extension to a ps1 script. The DEEP#GOSU campaign linked to Kimsuky staged its PowerShell payload with this uncommon double extension before renaming and executing it.

Suspicious In-Memory Runspace Execution via PowerShell Script Block

This rule detects PowerShell script content that creates a new runspace and passes deobfuscated code to Invoke-Expression. A profile resident backdoor uses a dedicated runspace and script block to run its command and control loop in memory without touching disk.

Suspicious PowerShell Payload Extraction from PNG Polyglot via findstr

This rule detects use of the findstr utility to extract an appended PowerShell payload from a PNG image and pipe it into PowerShell for execution. This polyglot steganography technique conceals script code after the PNG end marker so it can be recovered with a native search utility and run in memory.

Suspicious Hidden PowerShell WebClient DownloadFile Cradle

This rule detects a hidden PowerShell process using the WebClient DownloadFile method to retrieve a remote file. A crypto stealer campaign uses this cradle with a hidden window to pull a decoy document and a bundled Python runtime from cloud file hosting.

Suspicious PowerShell Download Cradle with Spoofed User-Agent via MSIX

This rule detects a PowerShell download cradle that fetches and executes remote content while presenting a spoofed browser User-Agent string. A malicious MSIX package runs an obfuscated startup script that combines Invoke-WebRequest and Invoke-Expression to pull a next stage from an attacker server.

Suspicious Renamed PowerShell Copied from System32 via Batch Loader

This rule detects a command that copies the legitimate PowerShell executable from System32 to a new filename ending in exe. A multi payload batch loader clones powershell.exe under an attacker chosen name so its hidden execution of embedded base64 payloads evades name based detection.