Sigma detection rules, expert-reviewed

Detect PowerShell COMPRESS OBFUSCATION using ASCII text encoding and stream/compression APIs

Flags PowerShell script blocks that combine ASCII encoding with Deflate/stream handling indicative of obfuscated payload compression.

PowerShell module activity launching rundll32 via shell32.dll obfuscation content

Alerts when PowerShell module payloads reference a shell32/rundll32 launcher pattern that includes PowerShell.

PowerShell Module Payload Obfuscation Using COMPRESS OBFUSCATION

Identifies PowerShell module payloads containing ASCII encoding and compression/stream obfuscation strings.

Windows System: Detect rundll32 Service Control Manager launches PowerShell via obfuscated parameters

Flags service creation where ImagePath uses rundll32/shell32 (shellexec_rundll) to invoke PowerShell.

Windows System: Service Control Manager PowerShell Obfuscation Using COMPRESS OBFUSCATION

Flags new Windows services whose ImagePath includes obfuscated PowerShell markers using COMPRESS/stream decompression.

Windows Security 4697: Obfuscated PowerShell via rundll32 shell32 shellexec_rundll

Alert on Security EID 4697 where service installation references rundll32/shell32.dll to launch PowerShell.

Windows Security 4697 PowerShell obfuscated content using COMPRESS OBFUSCATION components

Alerts on service creation events where the ServiceFileName includes PowerShell obfuscation patterns tied to compression stream and ASCII encoding.

Windows PowerShell Script Execution via Redirected Input Stream

Flags PowerShell/pwsh executions where the command line includes redirected input ("- <").

Windows PowerShell Software Enumeration via Script Block Content

Flags PowerShell registry queries for installed software metadata combined with selection and table formatting.

PowerShell command-line obfuscation indicators from special-character patterns (Windows)

Alerts on PowerShell executions whose command lines contain repeated special-character obfuscation patterns.

Windows Process Creation: Cmd Invokes PowerShell via Obfuscated Environment Variable Expansion

Alerts on cmd.exe command lines that use obfuscated environment-variable SET to execute PowerShell.

Windows Process Execution Using Obfuscated CMD to Pipe STDIN into PowerShell

Detects obfuscated cmd executions that launch PowerShell and reference $input/noexit patterns for STDIN-based execution.

PowerShell: Obfuscated invocation via Environment Variables in Script Block

Alerts on PowerShell script blocks launching cmd /c or /r with obfuscated set-and-{n} variable expansion patterns.

PowerShell Obfuscated stdin launcher using cmd /c or cmd /r patterns

Detects PowerShell script blocks that use obfuscated STDIN-driven cmd/powershell execution patterns.

PowerShell Module: Obfuscated Environment Variable Expansion via cmd /c set -f Pattern

Alerts when PowerShell module payloads obfuscate execution via cmd /c|/r and environment-variable-based set patterns.