Sigma detection rules, expert-reviewed

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

This rule detects a Python process spawning PowerShell with an encoded command, the behavior of the checkbalance.py component in this Emmenhtal and Amadey MaaS operation that uses subprocess.run to execute obfuscated PowerShell. A Python-to-encoded-PowerShell parent-child relationship is unusual on endpoints and indicates scripted payload execution.

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

This rule detects wscript.exe or cscript.exe executing a .js file and spawning PowerShell with an encoded command. The Emmenhtal loader used in this MaaS operation against Ukrainian entities runs JavaScript such as Work.js via WScript.Shell to launch encoded PowerShell that fetches the Amadey payload, so this script-to-encoded-PowerShell chain is the core delivery behavior.

Suspicious PowerShell Download of lib.zip Archive

This rule detects PowerShell using Invoke-WebRequest or curl to download an archive named lib.zip. Famous Chollima's Python GolangGhost RAT chain fetches this archive, which is then unpacked and used to launch a renamed Python interpreter, so this ingress step precedes RAT execution and Run-key persistence.

Suspicious PowerShell Remote Payload Download via IEX DownloadString

This rule detects PowerShell invoking Invoke-Expression together with a WebClient DownloadString call which the attackers used to fetch and execute in memory payloads during the campaign targeting Japan. Combining remote content download with immediate expression execution is a common fileless delivery technique.

Malicious PowerShell Spawned by PHP CGI Process

This rule detects the php-cgi.exe process spawning PowerShell which indicates exploitation of CVE-2024-4577 argument injection to achieve remote code execution on Windows PHP servers as seen in the persistent attacks against Japanese organizations. A web facing PHP CGI interpreter launching PowerShell is not expected during normal operation and signals server compromise.

Suspicious PowerShell Download Of Text-Disguised Payload

This rule detects PowerShell downloading a file with a .txt extension using a web download method. MoonPeak loaders retrieved a calc.txt file that was actually a GZIP-compressed RTF payload staged for later conversion and execution. Serving executable or archive content under an innocuous .txt name is a masquerading trick used to slip payloads past content filters.

Suspicious Script Host Spawning PowerShell With Bypass And Hidden Execution

This rule detects wscript.exe or cscript.exe spawning PowerShell with execution-policy bypass and no-profile command execution flags. This chain was observed delivering NetSupport RAT where a JavaScript ActiveXObject WScript.Shell launched PowerShell to fetch the payload. Script hosts invoking hidden bypass PowerShell is a common loader pattern that downloads and runs second-stage malware.

Malicious Edge Credential Parser Execution via PowerShell (via process_creation)

This rule detects execution of the edgeparser.ps1 script used by Turla in TinyTurla-NG operations to parse and steal Microsoft Edge Login Data. The script harvests saved browser credentials for onward access and lateral movement.

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

This rule detects the PS1Bot malware framework writing its PowerShell payload ntu.ps1 into the ProgramData directory. PS1Bot is delivered through malvertising and stages obfuscated PowerShell modules from this location for in-memory execution. Script files created in ProgramData outside of installer activity are a strong indicator of staging.

Suspicious PowerShell Execution via SyncAppvPublishingServer LOLBIN

This rule detects abuse of the signed SyncAppvPublishingServer.vbs script to proxy execution of PowerShell, a technique used in the GuLoader to Remcos infection chain. The LNK lure invokes this LOLBIN to run obfuscated PowerShell that stages shellcode. Detecting the script use surfaces the proxied execution step of the chain.

Suspicious Scheduled Task Running PowerShell Every Minute (via process_creation)

This rule detects creation of a scheduled task with a minute-based recurrence whose action launches PowerShell, the persistence and beaconing mechanism used by the TinyNote backdoor of Camaro Dragon. High-frequency scheduled tasks driving PowerShell are unusual for legitimate software and typically indicate implant callbacks.

Malicious Script Host Spawning PowerShell With Invoke-Expression (via process_creation)

This rule detects wscript or cscript launching PowerShell with an Invoke-Expression payload, the VBScript to PowerShell IEX chain used by GuLoader to deliver malware. A Windows script host spawning PowerShell to evaluate a downloaded string is a common in-memory execution pattern rarely produced by legitimate automation.

Hidden PowerShell Archive Extraction via ExtractToDirectory

This rule detects a hidden PowerShell process using the System IO Compression ZipFile ExtractToDirectory method together with an execution policy bypass. The Xeno loader uses this routine to unpack its bundled Java runtime and stealer payload.

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

This rule detects a ClickFix style command that decodes a hex encoded string in PowerShell and pipes the result into a second PowerShell instance for execution. This pattern delivers CastleLoader and related payloads directly in memory.

Suspicious PowerShell Hidden Web Download via Invoke-WebRequest by CatB Ransomware

This rule detects a hidden PowerShell or cmd invocation combining Invoke-WebRequest with DownloadData to retrieve a payload, matching the ingress tool transfer behavior emulated for CatB ransomware. Running the download in a hidden window is a common defense evasion tactic for staging follow-on malware.