Sigma detection rules, expert-reviewed

Malicious Firewall Deactivation - PowerShell (via powershell)

This rule detects disabled the Windows Firewall to evade defense.

Malicious Service Creation - PowerShell (via powershell)

This rule detects create a service for persistence.

ClickFix PowerShell In-Memory Execution via Invoke-RestMethod Piped to Invoke-Expression (via process_creation)

This rule detects the ClickFix golden pattern in which PowerShell retrieves a remote payload with Invoke-RestMethod and immediately runs it through Invoke-Expression, executing code entirely in memory. Adversaries leverage this download-and-run one-liner delivered through pastejacking overlays, making the paired cmdlets a reliable ClickFix execution indicator.

OpenSSH Native Server Feature Installation (via powershell)

This rule detects enables the native OpenSSH server feature on Windows to perform stealthy lateral movement.

Malicious Service Abuse with Backdoored "command Failure" - Reg via PowerShell (via powershell)

This rule detects modify the configuration of a service to trigger an action when the service is crashed.

PowerShell Encoded or Download-Cradle Command Line (via process_creation)

This rule detects PowerShell launched with an encoded command or an in-memory download-and-execute cradle on its command line, such as base64-encoded payloads or remote content pulled through Net.WebClient and piped into Invoke-Expression. PowerShell abuse is the single most prevalent technique in the Red Canary Threat Detection Report, used to stage and run payloads while evading disk-based controls. Flagging these command-line patterns catches the execution stage before follow-on activity.

Masquerading sLoad Ramnit Loader Execution via PowerShell Running a Masqueraded Log Script (via process_creation)

This rule detects PowerShell launching with an execution-policy bypass to run a script masqueraded as a .log file, the loader behavior used by the sLoad downloader to execute the encrypted Ramnit payload in the drIBAN banking-fraud operation. Adversaries rename PowerShell scripts to log extensions so the interpreter runs untrusted code while evading extension-based controls, making early detection critical for catching the loader before Ramnit injection.

PowerShell Spawned by SharePoint Worker Process After ToolShell Exploitation (via process_creation)

This rule detects the SharePoint worker process w3wp.exe spawning PowerShell, the post-exploitation execution pattern seen after ToolShell CVE-2025-53770 web shell deployment where decoded payloads are written to disk. Adversaries leverage the worker process to run commands under IIS context, making early detection critical for catching hands-on-keyboard activity following server compromise.

Obfuscated IIS Worker Spawning Encoded PowerShell after SharePoint ToolShell (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning a command shell or PowerShell with a Base64-encoded command, the post-exploitation behavior observed after SharePoint ToolShell exploitation of CVE-2025-53770. Adversaries run encoded PowerShell from the web server context to install webshells and stage further tooling.

Obfuscated Encoded PowerShell Payload Deployed via Process Execution (via process_creation)

This rule detects deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.

BITS Payload Downloaded via PowerShell (via powershell)

This rule detects downloads a payload by abusing BITS software. For more precise information, inspect "Bits-client" event log and search for ID 59 and 60.

Malicious WMI Spwaning PowerShell Process - WMImplant (via process_creation)

This rule detects wMIimplant.

Obfuscated Encoded PowerShell Payload Deployed - PowerShell (via powershell)

This rule detects deployed a service pointing to a hidden and encoded PowerShell payload.

Malicious Event Log Cleared Using Diagnostics - Via PowerShell (via powershell)

This rule detects clear the event logs.

Malicious WMI Registration - PowerShell (via powershell)

This rule detects createsan instance of a WMI class using tools like WMImplant or PowerLurk.