Sigma detection rules, expert-reviewed

Malicious Microsoft Defender Critical Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Malicious Service Permissions Hijacked for Privileges Abuse - Reg via PowerShell (via powershell)

This rule detects modify the permissions of a service using native PowerShell commands in order to abuse its privileges. Note that it requires PowerShell 7 or higher.

PureHVNC Process Hollowing into RegAsm Spawned by PowerShell (via process_creation)

This rule detects RegAsm being spawned by PowerShell, the process-hollowing target used to run the PureHVNC RAT after a trojanized ScreenConnect installer downloads NvContainerRecovery.ps1. Adversaries inject PureHVNC into the .NET RegAsm host to hide under a trusted binary. RegAsm launched from PowerShell rather than build tooling is highly anomalous.

DoT (DNS Over TLS) Activation - PowerShell (via powershell)

This rule detects enable DNS over TLS in order to evade detection for command and control purposes.

In-Memory AMSI Bypass via amsiInitFailed Field Manipulation in PowerShell (via ps_script)

This rule detects a PowerShell script block that sets the amsiInitFailed field to True, the in-memory AMSI bypass used by the agent1.ps1 stage of an Azorult campaign smuggled through Google Sites. Forcing amsiInitFailed disables Antimalware Scan Interface inspection so later stages run unscanned, making this a high-confidence defense-evasion signal.

Malicious aspnet_compiler.exe Injection Host Spawned by PowerShell via process_creation

This rule detects the .NET build utility aspnet_compiler.exe being launched by PowerShell, the process-injection host abused by the multi-stage Phantom Stealer campaign to run reflectively loaded payload code. Spawning the signed compiler from a scripting engine is a wrong-context indicator that the stealer is hollowing a trusted binary to evade detection, exposing the injection before credential theft and SMTP exfiltration.

Malicious BitLocker Abuse for Ransomware via PowerShell (via ps_script)

This rule detects PowerShell that enables BitLocker while removing the key protectors which the ShrinkLocker ransomware does to encrypt drives and lock out the legitimate owner without leaving a recovery key.

Suspicious Group Discovery - PowerShell (via powershell)

This rule detects enumerate local or domain groups via PowerShell.

Suspicious PowerShell History Logging Disabled via PSReadLine (via process_creation)

This rule detects PSReadLine being configured to save no command history via Set-PSReadLineOption with SaveNothing, a defense-evasion action observed with the TinyTurla-NG backdoor. Disabling history persistence removes a valuable forensic record of attacker PowerShell activity.

Suspicious Creation of PowerShell Profile Script for Persistence

This rule detects creation or modification of a PowerShell profile script. Backdoors abuse the automatic execution of the profile file on every PowerShell launch to gain stealthy persistence, running an obfuscated loader each time a session starts.

Malicious In-Memory Payload Execution via PowerShell DownloadString (via process_creation)

This rule detects PowerShell downloading a script from a remote host and immediately executing it in memory using DownloadString together with Invoke-Expression, a fileless technique used by a ransomware actor after ColdFusion exploitation to run Cobalt Strike beacons and reverse shells. Combining a web download with immediate expression evaluation is a common malicious loader pattern.

Suspicious Hidden PowerShell Downloading Payload via ClickFix (via process_creation)

This rule detects PowerShell launched with a hidden window that immediately downloads and executes remote content. The ClearFake ClickFix lure tricks users into pasting a mixed-case PowerShell command that runs with a suppressed window to fetch its next stage. A hidden PowerShell window combined with download and execution cmdlets is characteristic of ClickFix social engineering.

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

This rule detects extract current Windows firewall configuration to prepare an attack.

Suspicious Hidden PowerShell Encoded IEX Execution

This rule detects PowerShell launched with stealth flags together with in-memory execution of Base64 content, matching the spyware loader from the Pakistan-targeted fake dating app campaign. The combination of hidden window, bypassed policy and IEX-decoded payload indicates fileless execution of downloaded malware.

Suspicious PowerShell Script Execution With Unrestricted Execution Policy

This rule detects PowerShell launched to run a script file while forcing an unrestricted execution policy. The GoPix banking trojan started its payload with an ExecutionPolicy Unrestricted -File command line delivered via a malicious LNK as reported by Kaspersky. Bypassing the execution policy to run an external script is a common defense-evasion step for script-based loaders.