Sigma detection rules, expert-reviewed

PowerShell Get-Clipboard Cmdlet Execution via CLI on Windows

Flags Windows command lines containing Get-Clipboard, indicating potential clipboard data collection via PowerShell.

Windows PowerShell Get-Clipboard Command Execution

Flags PowerShell activity that includes the Get-Clipboard command, which may be used to collect clipboard contents.

PowerShell Decompress via Expand-Archive

Alerts on PowerShell usage of Expand-Archive, a common decompression step attackers may use to unpack files.

PowerShell Local User Creation via New-LocalUser

Flags PowerShell usage of New-LocalUser, indicating creation of a Windows local user.

Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)

Flags HH.exe spawning CertReq/CertUtil/CMD/PowerShell/cscript/regsvr32/mshta and other common Windows execution utilities.

Windows PowerShell ScriptBlock containing WMImplant tool parameters

Alerts on PowerShell Script Block content containing WMImplant-related command and system-manipulation parameters.

Windows PowerShell execution with uncommon/suspicious parent process

Alerts when PowerShell is started from certain unusual parent processes that commonly indicate abuse.

PowerShell Downgrade Attempts via -Version 2 on Windows Process Creation

Alerts on PowerShell executions specifying a -Version 2 argument, consistent with potential downgrade attempts.

Windows: Suspicious Execution of CSharp Interactive Console via PowerShell

Alerts when PowerShell launches csi.exe, indicating possible interactive .NET code execution.

PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)

Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.

Windows Image Load: System.Management.Automation DLL Loaded by Non-PowerShell Process

Alerts when a non-PowerShell executable loads System.Management.Automation.dll on Windows, indicating possible PowerShell execution in another process.

Windows Process Creation: Detect Obfuscated PowerShell IEX Invocation from Invoke-Obfuscation

Detects PowerShell commands showing obfuscation markers consistent with Invoke-Obfuscation-powered IEX invocation.

PowerShell: Obfuscated IEX Invocation via Invoke-Obfuscation String/Variable Patterns

Alerts on obfuscated PowerShell IEX invocation strings built from Invoke-Obfuscation style concatenation patterns in ScriptBlockText.

PowerShell Module Obfuscated IEX Invocation via Invoke-Obfuscation Payload Patterns

Alerts when PowerShell module payloads contain patterns consistent with obfuscated IEX generation via Invoke-Obfuscation.

Windows System Service Creation of Obfuscated PowerShell IEX (Invoke-Obfuscation)

Flags Windows service creations whose ImagePath contains obfuscated PowerShell IEX invocation strings.