Sigma detection rules, expert-reviewed

Malicious PDF Editor Update Script Execution via PowerShell (via process_creation)

This rule detects PowerShell executing the named update scripts used by the trojanized PDF editor cluster (ConvertMate and PDFClick) that infiltrated environments through malicious ads. Adversaries run these scripts to register scheduled tasks and pull further payloads, making execution of the specific update script names a direct campaign indicator.

Suspicious Active Directory Forest PowerShell Class Called from a Non Administrative Host (via powershell)

This rule detects call the Active Directory Forest PowerShell class on a non administrative host in order to enumerate trusts, forests, domains, sites and subnet information.

Suspicious ScreenConnect Client Download via PowerShell (via process_creation)

This rule detects PowerShell using Invoke-WebRequest to download a ScreenConnect client setup installer. The FROZEN#SHADOW campaign deployed ScreenConnect as remote access tooling for persistence and hands-on-keyboard activity.

Malicious PowerShell Download Cradle From GitHub Raw (via process_creation)

This rule detects a PowerShell download cradle that pipes an Invoke-WebRequest against raw.githubusercontent into Invoke-Expression. Phantom Goblin uses this to fetch and execute its Go-compiled stealer binaries.

Malicious PowerShell Download Rename and Execute Chain via Script Block

This rule detects a PowerShell script block that downloads a file into the public directory with Invoke-WebRequest, renames it to an executable with Rename-Item, and launches it with Start-Process. RomCom uses this exact chain after its Firefox and Windows zero-day exploitation to stage and run its backdoor. This indicates scripted payload delivery following exploitation.

Malicious Domain Group Membership Change (via powershell)

This rule detects if a member is added to a domain group via PowerShell.

Malicious PowerShell or Command Shell Spawned by SQL Server via xp_cmdshell

This rule detects the SQL Server process sqlservr.exe spawning PowerShell or cmd.exe, behavior produced when the GhostRedirector group abuses the xp_cmdshell stored procedure to run operating system commands. A database engine launching a shell indicates SQL-based remote code execution used for downloading tooling and establishing footholds on Windows servers.

Malicious Service Abuse with Malicious ImagePath - Reg via PowerShell (via powershell)

This rule detects modify the original service executable path with a malicious one.

Windows Process Creation: Suspicious reg.exe or PowerShell Editing of WSL InstallLocation Registry

Flags reg.exe or PowerShell command lines editing the WSL InstallLocation registry value under Lxss MSI.

Suspicious PowerShell Download to AppData Intel Path

This rule detects PowerShell using DownloadFile to stage a payload into an AppData Intel directory as seen in the Foxit PDF exploitation chain. The attacker hides downloaded miner and RAT payloads under an Intel named folder in the user profile. Detecting the download cradle exposes remote payload retrieval.

Malicious Microsoft Defender Tampering via PowerShell MpPreference

This rule detects PowerShell disabling Microsoft Defender real-time monitoring or adding scan exclusions, the defense-evasion step performed by The Gentlemen ransomware before deploying its payload. Tampering with Defender protection settings is a high-confidence indicator of an adversary preparing to run malware unhindered.

Suspicious PowerShell Download of updserc Archive to AppData via ClickFix

This rule detects PowerShell downloading an archive named updserc.zip into the local AppData directory. This activity is part of a ClickFix phishing chain abusing Booking.com themed lures to stage the PureRAT loader. Pulling a named archive into AppData through PowerShell is an early loader step that precedes DLL side-loading and in-memory execution.

Obfuscated Encoded PowerShell Payload Deployed via Service (via security)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

Malicious Axios NPM RAT Renamed PowerShell Execution via wt.exe

This rule detects a PowerShell binary copied to wt.exe under ProgramData and executed with a hidden window and execution policy bypass, matching the Axios NPM supply chain incident where a post-install hook drops a RAT. Renaming powershell.exe to wt.exe masquerades the interpreter as Windows Terminal to evade name-based detection. Execution of a masqueraded interpreter from ProgramData with bypass flags is a strong compromise indicator.

Suspicious Fileless PowerShell Execution via Invoke-RestMethod Piped to IEX (via process_creation)

This rule detects PowerShell fetching remote content with Invoke-RestMethod and piping it straight into Invoke-Expression, the fileless delivery used by the SEO poisoning campaign impersonating Gemini and Claude Code installers. This pattern executes attacker-hosted script without touching disk. Some tooling uses irm iex legitimately, so review the target domain.