Sigma detection rules, expert-reviewed

BitLocker Feature Installation via ServerManagerCmd or PowerShell (via process_creation)

This rule detects on-demand installation of the BitLocker Windows feature through ServerManagerCmd or Install-WindowsFeature, the enabling step ShrinkLocker performs on systems where BitLocker is absent before hijacking it to encrypt drives. Adversaries leverage the native BitLocker feature to lock victim data without dropping a custom encryptor, so this behavior warrants review on hosts where BitLocker deployment is unexpected.

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

This rule detects forfiles.exe enumerating win.ini and using its command flag to launch PowerShell and mshta, matching the PEAKLIGHT LNK-driven infection chain that abuses forfiles as a proxy execution binary. This technique launches a memory-only downloader while evading direct process lineage detection.

Malicious PowerShell Spawned by IIS Worker Process via OWASSRF Exchange Exploitation (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning PowerShell, a post-exploitation pattern seen in the OWASSRF exploitation of Exchange CVE-2022-41080 and CVE-2022-41082 through Outlook Web Access. Attackers use this server-side execution to run reconnaissance and drop tooling after bypassing ProxyNotShell mitigations, so PowerShell descended from an Exchange web process is a strong compromise signal.

Suspicious Obfuscated PowerShell Spawned by explorer via Run Dialog

This rule detects powershell launched directly by explorer with obfuscation indicators which matches the paste and run or ClickFix technique used by Mocha Manakin to trick users into pasting a malicious command into the Run dialog. This user driven execution delivers a NodeJS backdoor while bypassing many download based defenses. Detecting explorer spawned obfuscated PowerShell surfaces the initial foothold.

Suspicious PowerShell With Reversed HTTP String (via process_creation)

This rule detects PowerShell command lines containing the reversed HTTP string used to hide C2 URLs. This steganography spam campaign reverses download URLs before reconstructing them at runtime.

Malicious Konni PowerShell Loader Reading Script from ProgramData via Invoke-Expression (via process_creation)

This rule detects PowerShell launched with an execution policy bypass that reads a script from the ProgramData directory and runs it through Invoke-Expression, the loader behavior of a Konni AsyncRAT LNK infection that drops d.ps1 into ProgramData. Adversaries leverage Get-Content piped into Invoke-Expression to execute a staged script while hiding the payload from the command line, making early detection critical for catching the loader before AsyncRAT deploys.

Malicious Print Spooler Privilege Escalation via Printer Added - CVE-2020-1048 (via powershell)

This rule detects abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.

Suspicious Encoded PowerShell Execution Following SharePoint Exploitation (via ps_script)

This rule detects PowerShell invoked with a base64 encoded command, used in ToolShell post-exploitation to stage payloads while obscuring intent. Encoded command execution on SharePoint servers exploiting CVE-2025-53770 indicates hands-on-keyboard activity following initial access.

DCOM Lateral Movement - Via MMC20 (via powershell)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Fileless PowerShell Registry Payload Execution via Process Creation

This rule detects hidden PowerShell that reads a payload from a registry value and pipes it to Invoke-Expression. StripedFly stores its encrypted loader under an HKCU Applets key and executes it fileless via hidden PowerShell with IEX, achieving stealthy in-memory execution.

PowerShell Command-Line Obfuscation Constructs (via process_creation)

This rule detects PowerShell command lines that use format-operator, character-array, backtick or string-reversal obfuscation to hide the real payload from simple string matching. Command obfuscation accompanies the heavy PowerShell abuse documented in the Red Canary Threat Detection Report, and these constructs are rarely produced by legitimate one-liners. Detecting the obfuscation syntax surfaces evasive script execution regardless of the ultimate payload.

Suspicious Hidden PowerShell Download and Archive Expansion

This rule detects hidden-window PowerShell that downloads content with Invoke-WebRequest and expands an archive in the same command. This chain was used to retrieve and unpack the XWorm loader, combining ingress tool transfer with a hidden window to evade user awareness.

Suspicious PowerShell Spawning wscript with Silent Flag (via process_creation)

This rule detects PowerShell launching wscript.exe with the silent background flag to run a JScript wrapper. This chain was observed in the JS#SMUGGLER campaign to execute the NetSupport RAT loader while suppressing script errors.

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

This rule detects enabling of the Network Discovery firewall rule group via PowerShell, the step The Gentlemen ransomware took to widen host visibility for lateral movement. Programmatically enabling network discovery firewall rules during an intrusion facilitates spread across the environment.