Sigma detection rules, expert-reviewed

Malicious PowerShell In-Memory Download Cradle via Script Block (via ps_script)

This rule detects a PowerShell download cradle that pulls a remote payload with Net.WebClient DownloadString and pipes it directly to IEX for in-memory execution, the tmp.48 stager observed in the Confluence exploit ransomware campaign by Red Canary. This pattern fetches and runs code without touching disk and is a common loader technique across intrusions.

Suspicious PowerShell Reflective Assembly Load With Registry Property Read via Script Block (via ps_script)

This rule detects PowerShell that reads data from a registry value and reflectively loads a .NET assembly in memory, the obfuscated in-memory loading behavior Gootloader uses per Red Canary. Reflective assembly loading combined with registry-stored payloads avoids writing an executable to disk, so this combination is a strong indicator of fileless second-stage execution.

Suspicious node.exe Execution Spawned by PowerShell

This rule detects the Node.js runtime being launched by PowerShell which is the loader behavior of the Mocha Manakin NodeInitRAT backdoor. Delivering a backdoor through node.exe lets adversaries run a full featured JavaScript implant while masquerading as a legitimate developer tool. Detecting node spawned from PowerShell surfaces execution of the custom backdoor.

Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)

This rule detects mshta.exe spawning powershell.exe, the FakeSG execution chain Red Canary highlighted where a malicious HTA launches PowerShell to continue the infection. The HTML Application host launching PowerShell is uncommon in legitimate activity, so this parent-child pairing indicates script-based execution through a living-off-the-land binary.

Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)

This rule detects PowerShell command lines combining base64 decoding with stream decompression routines that Red Canary tied to obfuscated loaders staging Cobalt Strike during a hospital ransomware attack. Adversaries chain FromBase64String with stream decompression to unpack in-memory payloads, so these combined tokens reveal obfuscated execution that plain string matching would miss.

Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)

This rule detects wscript.exe spawning powershell.exe, the process chain Red Canary observed when Scarlet Goldfinch first-stage JScript from an updateinstaller.zip lure launched an obfuscated PowerShell command to continue the infection toward NetSupport Manager. Script hosts rarely launch PowerShell during normal use, so this parent-child relationship is a reliable indicator of script-driven execution.

Suspicious Windows Defender Exclusion Added via PowerShell via Process Creation (via process_creation)

This rule detects PowerShell adding Windows Defender exclusions or disabling real-time monitoring via Add-MpPreference or Set-MpPreference, a defense-evasion step used by malware delivered through MSIX installers per Red Canary. Attackers carve out exclusion paths so their staged payloads run unscanned, making unexpected exclusion changes a strong impairment-of-defenses signal.

Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)

This rule detects the MSIX StartingScriptWrapper.ps1 launching PowerShell from the WindowsApps directory, the installer-driven execution vector Red Canary tracked across multiple malware delivery campaigns. Legitimate apps rarely use this wrapper to run scripts, so its appearance signals a malicious MSIX package executing embedded PowerShell during installation.

Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)

This rule detects the Apache Tomcat process (which backs Confluence) spawning cmd.exe or powershell.exe, the post-exploitation behavior seen when adversaries exploited a Confluence vulnerability to deploy ransomware per Red Canary. A web application server launching a command interpreter almost always indicates successful remote code execution against the exposed service.

Suspicious PowerShell Writing Shortcut to Startup Folder for Persistence (via file_event)

This rule detects powershell.exe creating a .lnk shortcut inside the Start Menu Programs Startup folder, the Yellow Cockatoo persistence Red Canary tied to a PowerShell payload staged from AppData. Writing a shortcut to the startup folder guarantees re-execution at logon, so a script host dropping a .lnk there indicates autorun persistence.

Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)

This rule detects PowerShell invoking Invoke-Expression against the output of a DownloadString call. Rapid7 observed this in-memory download cradle in the exposed WebDAV malware delivery lab to fetch and execute remote script content without touching disk. Combining a remote download with immediate execution is a hallmark of fileless payload delivery.

Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)

This rule detects mshta.exe spawning a hidden-window PowerShell process, a chain TA584 used for boot persistence via a WScript.Shell one-liner that decodes a remote Base64 script on each logon.

Suspicious PowerShell Download to Temp and In-Memory Execution via IEX (via process_creation)

This rule detects PowerShell using iwr to save content into the temp directory and then piping it to iex for in-memory execution. TA427 pasted this ClickFix command to fetch a payload to a temp file and immediately run it.

Suspicious PowerShell Download of Bumblebee Stager Files (via process_creation)

This rule detects PowerShell referencing the stager filenames update_ver or w_ver.dat used in the Bumblebee delivery chain. These files were fetched from the download server before the Bumblebee DLL was executed.

Malicious HTA Payload Download and Execution via PowerShell One-Liner (via process_creation)

This rule detects a PowerShell one-liner that downloads an HTA file to disk and immediately launches it. TA571 ClickFix chains used this pattern to fetch default.hta into the public user directory and start it to install DarkGate.