Sigma detection rules, expert-reviewed

Suspicious Volume Shadow Copy Deletion via PowerShell WMI by Akira Ransomware

This rule detects PowerShell deleting Volume Shadow Copies through the Win32_ShadowCopy WMI class, an inhibit-recovery step used by Akira ransomware before encryption. Removing shadow copies prevents victims from restoring files without paying.

Suspicious Mass Windows Event Log Clearing via PowerShell (via ps_script)

This rule detects a PowerShell one-liner enumerating all event logs and clearing them through the EventLogSession GlobalSession ClearLog method. Qilin ransomware operators used this to wipe forensic evidence across every log on compromised hosts.

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

This rule detects a non-interactive PowerShell process launched with an encoded command from a command shell. This staging pattern was observed during exploitation of Cleo managed file transfer software to decode and run the next-stage payload for the Cleopatra backdoor.

Malicious ActiveMQ Exploitation Java Spawning PowerShell Downloader (via process_creation)

This rule detects an ActiveMQ Java process spawning PowerShell that downloads a remote payload. Exploitation of CVE-2023-46604 caused the ActiveMQ java process to launch PowerShell IEX and DownloadFile commands to stage ransomware.

Suspicious PowerShell Spawned by VBScript for RMM Delivery

This rule detects wscript.exe spawning a PowerShell process that skips the user profile, the delivery chain of the 46-country RMM phishing campaign that fetches and installs remote-access tools. A script-host parent driving profile-skipping PowerShell is characteristic of malicious RMM deployment.

Suspicious Banana RAT UAC Skip Environment Variable in PowerShell

This rule detects the MSEDGE_SKIP_UAC environment variable being set within a PowerShell command line, a marker used by Banana RAT during staging to bypass user prompts. This variable is not used by legitimate Microsoft Edge update processes.

Suspicious PowerShell Loading Fake Edge Update Script

This rule detects a PowerShell process that reads and invokes a msedgeupdate.txt payload, the staging technique used by Banana RAT to masquerade as a Microsoft Edge updater. Loading a text file from disk through PowerShell is a strong loader indicator when tied to this filename.

Suspicious Hidden PowerShell Executing Substring of Dropped File

This rule detects a hidden PowerShell process that reads a dropped file with Get-Content, extracts a substring, and invokes it as code, matching the AZORult fileless loader stage. Reading an oddly named data file and executing a slice of it is characteristic of obfuscated PowerShell stagers.

Malicious Ladon PowerShell Attack Framework Import (via process_creation)

This rule detects PowerShell importing the Ladon attack framework module and invoking its modules such as SweetPotato, Runas, or MssqlCmd as observed in the MeshAgent and SuperShell intrusion. Ladon provides scanning, privilege escalation, and lateral movement capabilities.

In-Memory AMSI or ETW Bypass in PowerShell (via process_creation)

This rule detects PowerShell command lines containing AMSI or ETW bypass constructs (AmsiScanBuffer, amsiInitFailed, System.Management.Automation.AmsiUtils or EtwEventWrite patching), which blind script scanning and telemetry so malicious code runs undetected. AMSI and ETW tampering is a defense-evasion technique highlighted in the Red Canary Threat Detection Report. Detecting these strings surfaces an attacker disabling instrumentation before executing a payload.

Possible Clipboard Data Capture via PowerShell (via process_creation)

This rule detects PowerShell reading the clipboard through Get-Clipboard or the Forms Clipboard class, a collection technique used to steal copied passwords, tokens or wallet addresses. Clipboard capture is tracked in the Red Canary Threat Detection Report. Detecting these calls surfaces harvesting of sensitive copied data.

PowerShell Proxy Execution via SyncAppvPublishingServer (via process_creation)

This rule detects SyncAppvPublishingServer being used to smuggle a PowerShell command through its argument, a signed-binary proxy technique that runs script code while masking the parent as a trusted App-V component. SyncAppvPublishingServer abuse is a defense-evasion technique tracked in the Red Canary Threat Detection Report. Detecting this pattern surfaces script execution hidden behind a signed binary.

PowerShell Storing an Encoded Payload in the Registry (via process_creation)

This rule detects PowerShell writing a base64 or byte-array value into an HKCU registry key, the fileless persistence and staging behavior seen in Solarmarker and Yellow Cockatoo intrusions. Storing an encoded payload in the registry is a defense-evasion and persistence technique tracked in the Red Canary Threat Detection Report. Detecting this write surfaces a fileless payload being cached for later execution.

Suspicious File Timestamp Manipulation via PowerShell (via process_creation)

This rule detects PowerShell setting both CreationTime and LastWriteTime on a file, the hallmark of timestomping used to blend a dropped payload in with legitimate files and defeat timeline analysis. Timestomping is an indicator-removal technique tracked in the Red Canary Threat Detection Report. Detecting these property assignments surfaces anti-forensic tampering with file metadata.

Suspicious LSASS Credential Dump with LSASSY - PowerShell (via powershell)

This rule detects remotely dump LSASS credentials using the LSASSY tool.