Sigma detection rules, expert-reviewed

Malicious Windows Defender Exclusion Added via PowerShell (via process_creation)

This rule detects PowerShell using Add-MpPreference to register a Microsoft Defender path exclusion, a defense-evasion step the Silent Skimmer actor performed to protect payload directories from scanning. Excluding attacker-controlled folders lets malware run and persist without antivirus detection.

Suspicious LSASS Credential Access via PowerShell (via process_creation)

This rule detects PowerShell command lines referencing lsass, the mechanism the extortion actor used to dump credentials from the Local Security Authority Subsystem Service memory. Reading or dumping LSASS through PowerShell exposes plaintext credentials and hashes for lateral movement.

PowerShell: Defendnot hacktool installation via one-liner fetching dnot.sh

Flags PowerShell one-liners that reference dnot.sh and GitHub/defendnot paths consistent with Defendnot installation.

Malicious PowerShell Download Cradle Spawned by Quick Assist

This rule detects Quick Assist spawning PowerShell that uses an IEX DownloadString cradle to fetch and execute remote code, the initial-access chain seen when a social-engineering operator drives the victim through Quick Assist to run attacker payloads. A remote-support tool launching an in-memory download cradle is a strong indicator of a tech-support scam intrusion.

Suspicious Data Exfiltration to webhook.site via PowerShell Invoke-WebRequest (via ps_script)

This rule detects PowerShell piping command output through Out-String into Invoke-WebRequest targeting webhook.site. Threat actors used this technique to exfiltrate host reconnaissance output to an attacker-controlled request-capture endpoint.

Suspicious PowerShell Download and Execute via iwr Piped to iex

This rule detects PowerShell fetching remote content with Invoke-WebRequest and piping it into Invoke-Expression, a loader pattern used to deliver StealC and Amadey infostealers. Downloading and directly executing script content in memory bypasses file based controls and is a common malware staging technique.

Suspicious Microsoft Defender Exclusion Added for TEMP and PowerShell via Add-MpPreference

This rule detects use of Add-MpPreference to add Microsoft Defender exclusions for the user TEMP directory and the powershell.exe process. This behavior was observed in Node.js malvertising campaigns tracked by Microsoft that stage malicious payloads in TEMP. Attackers use it to blind endpoint protection before executing staged malware, so alerting on it exposes early defense evasion.

Suspicious ScreenConnect Remote Access Client Spawning PowerShell (via process_creation)

This rule detects a ScreenConnect remote-access client process spawning PowerShell or cmd, an abuse of legitimate remote-management software used by the Seashell Blizzard subgroup to run commands on compromised hosts during the BadPilot campaign. Because adversaries co-opt installed RMM tooling to blend into normal administration, scripting children of ScreenConnect warrant scrutiny in environments where such automation is not expected.

Suspicious PowerShell Compress-Archive of Signal Configuration by Turla (via ps_script)

This rule detects PowerShell using Compress-Archive to package Signal configuration and database files, the collection step Turla performed to stage Signal data for exfiltration. Archiving a specific messaging application data directory indicates targeted collection of private communications.

Suspicious APT42 Remote Payload Download via PowerShell Web Client (via ps_script)

This rule detects PowerShell using wget, curl, or Invoke-WebRequest aliases to retrieve a remote configuration or payload file such as nconf.txt. APT42 pulled staged text-based payloads over PowerShell during post-compromise tooling deployment. Scripted retrieval of remote text payloads is a common ingress-tool-transfer behavior worth correlating with follow-on execution.

Suspicious PowerShell Loader Spawned by mshta via UNC5142 ClickFix

This rule detects mshta.exe spawning powershell.exe as observed in UNC5142 EtherHiding campaigns where an HTA disguised as an XLL launches an in-memory VIDAR or LUMMAC.V2 loader. Attackers abuse this chain to execute stager code from a fake browser update lure while evading disk based detection.

Suspicious ClickFix Clipboard PowerShell Execution from Run Dialog

This rule detects PowerShell launched directly by explorer.exe while fetching and executing remote content inline, matching the ClickFix fake-CAPTCHA lure that tricks users into pasting an attacker command into the Windows Run prompt to stage the LOSTKEYS downloader. This user-driven execution grants COLDRIVER an initial foothold without dropping a file to disk.

Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)

This rule detects PowerShell launched with the hidden window, unrestricted execution policy and no-profile flag combination used by the PEAKLIGHT downloader to fetch and AES-decrypt a memory-resident payload. This flag stacking is characteristic of obfuscated fileless staging.

Suspicious SharePoint File Download Using PowerShell User Agent

This rule detects SharePoint or OneDrive file download events whose user agent contains PowerShell as observed in ShinyHunters branded SaaS data theft. Attackers script bulk downloads of documents after harvesting SSO credentials through vishing.

Suspicious Scheduled Task Enumeration for User_Feed_Sync via PowerShell (via ps_script)

This rule detects PowerShell enumerating scheduled tasks matching the User_Feed_Sync name pattern which the DuneQuixote campaign uses to locate its CR4T implant persistence task on compromised Middle Eastern government systems.