Sigma detection rules, expert-reviewed

Suspicious PowerShell Remote TXT Payload Download Spawned by Shortcut via LNK (via process_creation)

This rule detects a PowerShell process launched from Explorer that downloads a remote text file used as a next-stage script. TA547 delivered LNK shortcuts that invoked PowerShell to retrieve and execute a hosted PowerShell payload from a .txt URL.

Suspicious In-Memory .NET Assembly Load via PowerShell Base64 Payload (via process_creation)

This rule detects PowerShell decoding a Base64 blob and reflectively loading it as a .NET assembly directly in memory. TA547 used this fileless technique to run the Rhadamanthys stealer without writing the payload to disk.

Suspicious PowerShell Shellcode Loader via Function Pointer Delegate

This rule detects PowerShell that fetches remote content and invokes GetDelegateForFunctionPointer to execute shellcode. The AdaptixC2 framework uses Invoke-RestMethod to retrieve a beacon and this delegate call to run it in memory. Combining a network fetch with function pointer delegation is a hallmark of in-memory shellcode loaders.

Suspicious PowerShell In-Memory Execution with AES Decryption

This rule detects PowerShell script blocks that combine Invoke-Expression with AES and base64 decryption routines. The DarkCloud stealer chain decrypts an obfuscated payload in memory and executes it via Invoke-Expression. Pairing in-memory execution with cryptographic decryption is characteristic of staged fileless loaders.

Malicious PowerShell Masquerading as Windows Terminal in ProgramData (via process_creation)

This rule detects an executable named wt.exe running from a ProgramData path, a masquerade used in the Axios supply chain attack where PowerShell was copied to %PROGRAMDATA%\wt.exe to impersonate Windows Terminal. The legitimate Windows Terminal never runs from ProgramData, so this location indicates a relocated payload used to evade detection.

Suspicious PowerShell Spawned by WScript via PhantomVAI Loader (via process_creation)

This rule detects PowerShell executed as a child of WScript, an early link in the PhantomVAI loader chain that proceeds through msedge and MSBuild to injection. Script-host to PowerShell transitions are a common malware execution handoff. Detecting this chain catches the loader before the final infostealer injection stage.

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

This rule detects MSBuild launched as a child of PowerShell, the final stage of the PhantomVAI loader chain that injects infostealer code into the trusted Microsoft build utility. MSBuild is abused as a signed process host to evade defenses. Detecting this parent-child relationship exposes process injection delivering commodity infostealers.

Suspicious ClickFix cv.bat Staging in Temp via PowerShell (via process_creation)

This rule detects PowerShell referencing the cv.bat helper script staged in a temporary directory, an intermediate step in the ClickFix delivery chain that subsequently retrieves an MSI-packaged DeerStealer payload. The batch file bridges the initial pasted command and the final installer. Detecting this staging step interrupts the infostealer infection before installation completes.

Suspicious PowerShell Download Spawned From Explorer via ClickFix (via process_creation)

This rule detects PowerShell launched directly by Explorer with download cmdlets, matching the ClickFix social engineering technique where a victim pastes a malicious command into the Windows Run dialog. The IUAM ClickFix Generator produces lures that trick users into self-executing payload downloaders. Detecting this pattern catches the delivery of DeerStealer and similar infostealers at execution.

Malicious SharePoint w3wp Spawning Command Shell and PowerShell

This rule detects the SharePoint IIS worker process w3wp.exe spawning cmd.exe or powershell.exe. Exploitation of the ToolShell SharePoint vulnerabilities results in the web worker launching shells to run base64 encoded commands. A web server process parenting an interactive shell strongly indicates webshell or exploitation activity.

Suspicious PowerShell Execution via Forfiles LOLBIN

This rule detects the forfiles utility used to spawn PowerShell, an indirect execution technique that breaks parent-child telemetry. Malicious LNK campaigns use forfiles to proxy execution of PowerShell payloads. Interactive use of forfiles to launch PowerShell is uncommon and suspicious.

Suspicious Encoded PowerShell Command Execution

This rule detects PowerShell invoked with an encoded-command switch, which conceals the executed script from casual inspection. Malicious LNK files analyzed by Unit 42 launch cmd to run PowerShell with EncodedCommand payloads. Base64-encoded PowerShell is a common obfuscation and execution technique that merits review.

Suspicious Lampion ClickFix PowerShell Download and Execute via Run Dialog

This rule detects PowerShell spawned from the Windows Run dialog that combines Invoke-WebRequest with Start-Process to download and launch a payload. This pattern is used by the Lampion banking malware ClickFix campaign that tricks users into pasting a malicious one-liner. Attackers abuse this social-engineering vector to gain initial code execution while blending into normal user activity.

Malicious Shadow Copy Removal via WMI PowerShell

This rule detects PowerShell enumerating and removing volume shadow copies through the Win32_Shadowcopy WMI class. This behavior matches Akira ransomware which deletes shadow copies via WMI to prevent recovery before encrypting files. Programmatic shadow copy removal is a strong impact indicator that precedes ransomware detonation.

Suspicious Hidden Encoded PowerShell Execution

This rule detects PowerShell launched with a hidden window, bypassed execution policy, and a base64-encoded command. This behavior matches the BlackSuit intrusion chain where operators run obfuscated encoded payloads to stage tooling while evading logging. The combination of hidden execution and encoding is a common obfuscation pattern used to conceal malicious in-memory activity.