Sigma detection rules, expert-reviewed

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

This rule detects the .NET Regasm.exe utility launched as a child of powershell.exe, the process-hollowing target used by 0bj3ctivityStealer to inject its final stealer payload. Adversaries leverage Regasm as a signed injection host that seldom runs from PowerShell, making this parent-child pairing a reliable indicator of code injection.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Suspicious Screen Capture via PowerShell Graphics API (via process_creation)

This rule detects PowerShell invoking the CopyFromScreen graphics method to grab the desktop, a screen-capture collection technique used to spy on a victim's session. Screen capture is tracked in the Red Canary Threat Detection Report. Detecting the graphics-API call surfaces surveillance of the user's screen.

DSRM Password Changed - Reg via PowerShell (via powershell)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Suspicious PowerShell Indirect Execution via Get-Command

This rule detects PowerShell using Get-Command together with the call operator to resolve and invoke a cmdlet indirectly which the Gamaredon LNK delivery chain uses to obscure calls to Invoke-Expression and evade command line based detection. Piping or passing Get-Command output into an invocation operator is an obfuscation pattern rarely seen in legitimate scripts.

Scheduled Task Creating Per-Minute Hidden PowerShell Execution

This rule detects schtasks creating a task that runs at a one-minute interval and launches a hidden PowerShell script. The GPU miner campaign registered a scheduled task firing every minute to run hidden powershell against cor.ps1 or core.ps1 for persistence and re-infection. A minute-cadence hidden PowerShell task is a strong indicator of automated malware persistence.

Malicious ClickFix PowerShell DownloadFile Loader with Hidden Window

This rule detects a hidden-window PowerShell process using DownloadFile to fetch a script from a remote host, the NetSupport RAT ClickFix loader pattern. Victims pasted a command that ran PowerShell with hidden window and no-profile flags to download and then execute a follow-on .ps1 payload. Hidden PowerShell combined with a remote file download is a classic first-stage loader behavior.

Enable WDigest using PowerShell

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Malicious PowerShell Download Cradle via Invoke-WebRequest and IEX

This rule detects PowerShell run with an execution policy bypass that downloads content and pipes it directly to Invoke-Expression. Stealerium uses powershell -eP Bypass with Invoke-WebRequest to pull an atom feed from a blogspot dead drop and execute it in memory with IEX. This download-and-execute cradle is a widely abused fileless staging technique.

Suspicious Silent MSI Installation from AppData Spawned by PowerShell (via process_creation)

This rule detects msiexec.exe spawned by PowerShell to silently install an MSI staged in the user AppData directory, the second step of the Bumblebee loader chain where PowerShell writes y.msi to AppData and installs it with no user interaction. Legitimate software rarely installs MSIs from AppData under a PowerShell parent, so this parent-child and path combination surfaces the loader stage.

Malicious PowerShell IEX DownloadString One-Liner

This rule detects PowerShell using Invoke-Expression together with a WebClient DownloadString call to fetch and run remote code in memory. This one-liner is delivered through the Win+R fake CAPTCHA lure used to distribute Lumma Stealer. Catching the fetch-and-execute pattern flags fileless staging before the stealer touches disk.

Suspicious Credential Store Access for WinSCP and PuTTY via PowerShell (via ps_script)

This rule detects PowerShell script content referencing WinSCP and PuTTY session registry stores or the Windows Credential Manager enumeration API, the credential theft behavior of the SEO poisoning infostealer. These paths and calls harvest saved SSH, SFTP and enterprise credentials. Scripts touching these secrets stores are a strong credential access indicator.

OpenSSH Server Firewall Configuration on Windows - PowerShell (via powershell)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

This rule detects PowerShell activity that extracts and decrypts stored credentials from a Veeam backup server database. Abyss Locker operators ran an obfuscated variant of a public Veeam credential dumping script to recover accounts for lateral movement before deploying ransomware. Legitimate use of such scripts against production backup servers is uncommon.