Sigma detection rules, expert-reviewed

Suspicious PowerShell Masquerading as Windows Terminal via process_creation

This rule detects a process whose original file name is PowerShell but which executes under the wt.exe Windows Terminal file name. The axios supply chain payload renamed powershell.exe to wt.exe to evade name-based detection, so a mismatch between the internal PowerShell identity and a wt.exe image name indicates a masqueraded interpreter.

Suspicious Hidden PowerShell Download Cradle via ClickFix (via process_creation)

This rule detects a hidden window PowerShell process invoking DownloadString to pull a remote second stage, matching the HarborWatch ClickFix chain that runs a base64 command to fetch code from a remote text file. A hidden PowerShell window combined with a web download is a strong indicator of scripted delivery.

PipeShell Exfiltration Over Named Pipes (via powershell)

This rule detects establishes "PipeShell" connection(s) between a server and client(s) in order to move laterally or exfiltrate data. The server side will trigger "ServerStream" IOCs meanwhile the client side will trigger "ClientStream" IOCs. The rule works based on this condition, where at least 2 hosts need to trigger one of the condition.

Suspicious PowerShell Locating and Running MSBuild Project (via process_creation)

This rule detects a PowerShell one-liner that recursively searches for msbuild.exe and downloads a project file into ProgramData for execution. This ClickFix style command was observed in the PHALT#BLYX campaign.

Malicious PowerShell AMSI Bypass via AmsiInitFailed Command Line

This rule detects the amsiInitFailed AMSI-bypass string in a PowerShell command line, a defense-evasion technique used after Citrix Bleed exploitation to disable script scanning before running the LockBit toolkit. Setting amsiInitFailed forces AMSI to skip inspection. Detecting the string exposes an active attempt to blind endpoint script scanning.

Suspicious PowerShell Self-Delete Of Executable via Process Creation

This rule detects PowerShell used to delete an executable in a wait-and-retry loop. Rhysida ransomware removes its own binary after execution using a PowerShell routine that loops on Test-Path and Start-Sleep until the file is gone, eliminating forensic artifacts.

Possible PowerShell Hidden Download Cradle via Process Creation

This rule detects PowerShell launched with hidden window and no-profile flags executing an in-memory download cradle that uses Net.WebClient DownloadString. Observed in NCC Group research on TA505 exploiting the SolarWinds Serv-U vulnerability CVE-2021-35211 for initial access. This technique stages remote payloads directly in memory to evade disk-based detection which makes it a high-value indicator.

Suspicious PowerShell Spawned by Windows Script Host via Process Creation (via process_creation)

This rule detects powershell.exe spawned as a child of wscript.exe or cscript.exe, the wscript to cscript to PowerShell chain characteristic of Gootloader documented by Red Canary. Script hosts rarely need to invoke PowerShell in benign workflows, so this parent-child relationship is a high-confidence signal of staged script-based malware executing its next-stage payload.

Suspicious PowerShell Communication with Dropbox API (via ps_script)

This rule detects PowerShell script content that contacts the Dropbox content API file download endpoint. The DEEP#GOSU campaign abused Dropbox as a staging and exfiltration channel for encrypted payloads and stolen data.

Suspicious PowerShell Bypass Spawned by wscript Script Host

This rule detects wscript spawning PowerShell with an execution policy bypass, the initial handoff in a Huntress-analyzed malspam-to-loader chain that led to an in-memory .NET loader. A script host launching PowerShell with bypass flags reflects a scripted download-and-execute stage rather than normal administration. This parent-child pattern is a common malspam loader behavior.

Suspicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell adding a Microsoft Defender exclusion via Add-MpPreference. The SonicCrypt crypter behind TA585 MonsterV2 deliveries added its payload to Defender exclusions to evade scanning.

Malicious Microsoft Defender Default Action Changed to Allow Any Threat - PowerShell (via powershell)

This rule detects change Defender default action to allow any threats.

Suspicious PowerShell Spawning .NET LOLBIN (via process_creation)

This rule detects PowerShell spawning uncommon .NET framework utilities used as living-off-the-land execution proxies. The Veil#Drop loader cascaded through these binaries as fallback execution paths for its payload.

Mshta Spawning PowerShell or Command Shell

This rule detects mshta.exe spawning powershell.exe or cmd.exe as a child process. YoroTrooper used an HTA to JScript to PowerShell execution chain to run reverse shells and stage further tooling. Mshta launching a scripting interpreter is a classic proxy-execution and living-off-the-land pattern used to evade application controls.

Suspicious PowerShell Interactive Shell Spawn with Console Output Encoding

This rule detects PowerShell launched with a persistent interactive session that explicitly forces the console output encoding to UTF-8, a pattern used by Sliver C2 implants when spawning an interactive shell channel to the operator. Attackers use this to run hands-on-keyboard commands through the C2 tunnel. Catching this reveals active operator interaction on a compromised host.