Sigma detection rules, expert-reviewed

Malicious SessionGopher Credential Extraction via PowerShell (via ps_script)

This rule detects invocation of the SessionGopher tool through PowerShell which LockBit builder-based ransomware operators use to extract saved session credentials from PuTTY WinSCP and RDP prior to lateral movement and encryption.

Suspicious PowerShell Reading Base64 Payload from MI_V Environment Variable via process_creation

This rule detects PowerShell referencing the MI_V or MI_V2 environment variables that the Argamal RAT uses to stage base64 encoded script payloads. Passing encoded stages through custom environment variables hides the command line and defeats simple string logging. This staging pattern is a strong execution and obfuscation indicator.

Malicious DAEMON Tools Supply Chain Payload Download via PowerShell WebClient (via process_creation)

This rule detects PowerShell using a WebClient DownloadFile call to stage a payload into the Windows Temp directory, an action tied to the DAEMON Tools supply chain compromise. The download retrieves second stage backdoor components after a trojanized installer runs. Detecting the download to Temp surfaces the payload staging step of the intrusion.

Malicious Silver Fox PowerShell Download Cradle via irm and iex (via process_creation)

This rule detects PowerShell combining Invoke-RestMethod with Invoke-Expression to download and directly execute remote content, the delivery cradle used by the Silver Fox ABCDoor campaign. The technique retrieves and runs backdoor code in memory following a tax themed phishing lure. Detecting the irm to iex pattern surfaces staged payload execution.

Suspicious PowerShell Decoding Base64 Payload Stored in Registry

This rule detects PowerShell reading a value from the HKLM SOFTWARE\System key and base64 decoding it in memory. The ClipBanker loader stored a base64 PowerShell stage inside a registry Config value and used a scheduled task to decode and run it as documented by Kaspersky. Fileless retrieval of an encoded payload from the registry is a hallmark of staged, evasive execution.

Suspicious PowerShell WebClient UploadString Network Beacon

This rule detects PowerShell using a Net.WebClient object with the UploadString method to send data to a remote server. The GoPix banking trojan used LNK-launched PowerShell to POST victim data and receive tasking via WebClient UploadString as documented by Kaspersky. The uploading variant of WebClient is uncommon in benign scripting and indicates outbound command-and-control or data exfiltration.

Suspicious PowerShell Execution of AdobeMon Script with Bypass Policy

This rule detects PowerShell running a script named AdobeMon.ps1 with an execution policy bypass. Cloud Atlas launched an AdobeMon PowerShell payload with the bypass policy as documented by Kaspersky. The combination of the bypass flag and this specific script name indicates malicious PowerShell execution and defense evasion.

Suspicious PowerShell Execution Bypass Running Script From ProgramData

This rule detects PowerShell launched with an execution policy bypass to run a script stored in C\ProgramData, matching the ToddyCat loader that executed c\programdata\ip445.ps1. Staging scripts in the world-accessible ProgramData directory and bypassing execution policy is a common tradecraft for running attacker tooling with minimal friction. The combination is unusual for legitimate administrative scripts.

Suspicious cmd.exe Launching Encoded PowerShell From Shortcut File

This rule detects cmd.exe spawning PowerShell with an encoded command, a chain used by the Maverick banking Trojan distributed through WhatsApp. The malicious LNK launches cmd.exe which decodes and passes an obfuscated command to PowerShell. This layered command interpreter abuse is a common initial-access execution pattern designed to hide the real payload from casual inspection.

Suspicious Cursor Editor Process Spawning PowerShell

This rule detects the Cursor AI editor spawning PowerShell which a malicious open-source extension abuses to run its payload through the trusted editor process. This supply-chain compromise turned a Cursor package into a crypto heist that deployed Quasar and PureLogs via ScreenConnect. A code editor launching PowerShell is an uncommon and high-value execution path to monitor.

Suspicious PowerShell Enabling OpenSSH Server With Attacker Keys via process_creation

This rule detects PowerShell commands that reference the sshd service together with an authorized_keys file which indicates an attacker enabling the built-in Windows OpenSSH server for remote access. The DeepSeek trojan used a base64 PowerShell script to start the SSH service and plant attacker public keys for persistent tunneling. Turning a host into an SSH server with foreign keys is a strong backdoor indicator.

Suspicious PowerShell Base64 Encoded Staged Downloader via process_creation

This rule detects PowerShell executed with an encoded command combined with a hidden window and execution policy bypass which is typical of a staged malware downloader. TookPS used base64-encoded PowerShell stages to pull additional payloads before deploying the TeviRat and Lapmon backdoors. Encoded and hidden PowerShell invocations are a frequent early stage of intrusions and merit detection.

Malicious PowerShell UrlDecode Payload Spawned by SQL Server after FortiClient EMS Exploitation

This rule detects a command shell launching PowerShell that loads System.Web and calls UrlDecode as a child of the SQL Server process. Attackers exploiting the patched FortiClient EMS vulnerability use this chain to decode and run staged payloads through the exposed database service. A SQL Server process invoking encoded PowerShell indicates post-exploitation code execution.

Suspicious PowerShell Version Pinning with Encoded Command

This rule detects PowerShell started with an explicit -Version switch together with an encoded command and no-profile flags. The Ymir ransomware launched PowerShell this way to run obfuscated payloads in a controlled runtime while evading profile-based logging.

Suspicious Encoded PowerShell Spawned from Explorer via ClickFix

This rule detects PowerShell launched directly by explorer.exe with an encoded command, the signature of the ClickFix fake-CAPTCHA lure that tricks users into pasting a command into the Run dialog. This chain delivered Lumma and Amadey and a Run-dialog spawned encoded PowerShell is highly abnormal.