Sigma detection rules, expert-reviewed

Possible PowerShell Empire Default User-Agent In HTTP Traffic

This rule detects outbound HTTP traffic carrying the default user-agent string shipped with the PowerShell Empire C2 framework. In the WithSecure C2 and Exfiltration Lab 1 the Empire agent beacons out with an unmodified Mozilla compatible MSIE user-agent that is characteristic of the framework default profile. Attackers rely on this static header for their staging and command channel unless an operator customizes it.

Malicious Microsoft Defender Threat Exclusion Added - PowerShell (via powershell)

This rule detects scenarios where a threat exclusion is added to the antivirus in order to bypass its detection capacities.

Malicious PowerShell DownloadFile to AppData Executable

This rule detects PowerShell using the WebClient DownloadFile method to fetch an executable into the AppData directory. Warzone RAT runs obfuscated PowerShell that downloads gm.exe into %appdata% before establishing persistence and UAC bypass. Downloading executables into AppData via PowerShell DownloadFile is a common malware retrieval and staging behavior.

Windows Process Tree for Axios npm Supply-Chain RAT Droppers (cscript, curl, PowerShell)

Alerts on the Windows process/command-line pattern consistent with the Axios npm compromise execution and C2 fetch.

Windows File Creation Indicators Linked to Malicious Axios npm Supply-Chain Components

Flags Windows file creation of wt.exe/system.bat and temp .vbs/.ps1 payloads when created by node.exe or powershell.exe.

Windows System Restore Registry Modification via PowerShell or reg.exe Command Line

Flags PowerShell/reg.exe command lines modifying Windows System Restore registry keys to disable or restrict recovery.

Detect Email Forwarding/Redirecting via Exchange PowerShell InboxRule Cmdlets on Windows

Alerts when PowerShell script blocks reference Exchange inbox/rule cmdlets and forwarding/redirect parameters.

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

Windows PowerShell: New-InboxRule/Set-InboxRule Script Block Activity

Detects PowerShell script content using Exchange cmdlets to create or update inbox rules with message-manipulation actions.

Windows Vulnerable Driver Blocklist Registry Tampering via PowerShell or REG.EXE

Flags PowerShell/REG.EXE command lines that change the VulnerableDriverBlocklistEnable registry setting under \Control\CI\Config.

Windows HVCI Registry Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/pwsh or reg.exe command lines modifying HVCI/Hypervisor-enforced code integrity registry values.

Windows Registry: User Shell Folders Value Modification via reg.exe or PowerShell

Alerts when reg.exe or PowerShell modifies User Shell Folders/Shell Folders Startup-related registry values.

Windows Credential Guard Registry Key Tampering via reg.exe or PowerShell Command Line

Alerts on PowerShell/Reg.exe commands that add/modify/delete DeviceGuard/LSA registry values tied to Credential Guard.

Windows Process Creation: Registry Modification to Disable ETW AutoLogger via reg.exe or PowerShell

Flags reg.exe or PowerShell registry changes aimed at disabling WMI AutoLogger EventLog session components.

Windows Process Command-Line Tampering of AMSI Registry Values via reg.exe or PowerShell

Alerts on reg.exe or PowerShell command lines attempting to add/set AMSI enable registry settings.