Sigma detection rules, expert-reviewed

PowerShell Reflective Shellcode Loader via Dynamic API Delegates (via ps_script)

This rule detects a PowerShell Cobalt Strike loader that resolves Windows APIs through reflection helper functions and allocates executable memory before copying and running shellcode. Adversaries leverage dynamic delegate creation and VirtualAlloc to execute a beacon in memory while avoiding static API imports.

Malicious Veeam Credential Theft via PowerShell (via ps_script)

This rule detects a PowerShell script that decrypts stored Veeam Backup and Replication credentials using the ProtectedData Unprotect method against the Veeam database. Fog ransomware operators ran a Veeam-Get-Creds script to harvest backup infrastructure credentials.

Suspicious PowerShell Invoke-WebRequest Piped to Invoke-Expression via FakeBat Loader

This rule detects PowerShell downloading a remote payload with Invoke-WebRequest using a custom User-Agent and piping the response straight into Invoke-Expression. FakeBat, also tracked as EugenLoader, delivers this one liner through malvertising and fake software sites to stage its next component in memory. Fileless download and execute cradles like this bypass disk based controls and warrant investigation.

Suspicious Firewall Rule Added Using PowerShell or CMD (via firewall-as)

This rule detects scenarios where a firewall rule is added using PowerShell or CMD.

Obfuscated XE Group Reflective Loader via PowerShell Spawned by IIS Worker Process (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning a hidden PowerShell that runs a base64-encoded reflective loader, the in-memory execution step XE Group used after webshell access to launch Meterpreter. A web server process launching an obfuscated hidden PowerShell is a strong indicator of post-exploitation code execution.

Suspicious PowerShell Download to Disk Then Execute (via process_creation)

This rule detects PowerShell downloading a remote file and saving it to disk with an output path, a common precursor to executing a staged payload. AresLoader retrieves its DLL over HTTP with an OutFile parameter before starting the process. Download-to-disk followed by local execution is a recurring ingress-tool-transfer behavior.

Suspicious Security Software Discovery via PowerShell SecurityCenter2 AntivirusProduct Query (via process_creation)

This rule detects PowerShell querying the root/SecurityCenter2 AntivirusProduct WMI class, the security-software discovery step Troll Stealer runs while profiling a victim before credential theft. Adversaries enumerate installed antivirus to tailor evasion, so this query outside of administrative inventory tooling is a meaningful reconnaissance indicator.

Suspicious Encoded PowerShell with Hidden Window via Process Creation

This rule detects PowerShell invoked with a base64-encoded command while suppressing its window, the launcher behavior of the UAC-0099 LonePage VBS chain that decodes and runs a hidden beacon. Combining encoded payloads with a hidden window is a strong indicator of covert script execution rather than administrative use.

Malicious PowerShell Download from bullethost.cloud Staging Server

This rule detects PowerShell reaching out to the attacker-controlled staging host upload.bullethost.cloud to fetch a second stage archive into the user temp directory. This behavior was observed in the MUT-4831 campaign where trojanized npm packages ran a postinstall script that downloaded the Vidar infostealer. Blocking this early denies the actor credential and wallet theft capability.

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

This rule detects PowerShell script content invoking the Get-ComputerInfo cmdlet to enumerate detailed system information. A threat actor abusing a free Elastic Cloud SIEM trial ran this command to profile compromised hosts before exfiltrating the results, so its appearance in encoded or automated PowerShell is an early indicator of system discovery ahead of data theft.

Suspicious PowerShell Hidden Bypass Execution from ProgramData via Command Line

This rule detects PowerShell launched with hidden window, execution-policy bypass and non-interactive flags to run a script staged under C:\ProgramData. This behavior was observed in Operation PhantomControl delivering AsyncRAT, where operators execute obfuscated loader scripts to stay hidden. Detecting it exposes stealthy in-memory execution before RAT deployment.

Suspicious Microsoft Defender Security Components Disabled - PowerShell (via powershell)

This rule detects disable Defender security features in PowerShell.

Suspicious PowerShell AES Decryption and Reflective Method Invocation in SolarMarker

This rule detects PowerShell that combines AES decryption primitives with reflective type loading and method invocation, the in memory staging used by SolarMarker to decrypt and run its second stage. Chaining cryptographic decryption with reflection lets the loader keep the real payload encrypted on disk and only expose it at runtime.

PowerShell Remote Download From Bunny CDN Host

This rule detects PowerShell download activity referencing a b-cdn.net Bunny CDN host, an abused delivery infrastructure in the LummaStealer campaign. Attackers stage payloads on legitimate CDN domains to blend malicious downloads with normal traffic.

Suspicious PowerShell Invoke-WebRequest Download of Executable Payload

This rule detects PowerShell using Invoke-WebRequest to download an executable payload to disk. UAT-6382 used this technique after web-shell access to pull additional tooling from staging infrastructure over a non-standard port, a common ingress-tool-transfer step preceding beacon deployment.