Sigma detection rules, expert-reviewed

Suspicious MeshAgent Masquerading as NetworkDrivers Spawned by PowerShell

This rule detects a process named NetworkDrivers.exe launched by PowerShell. The Awaken Likho APT deployed the MeshAgent remote management agent under this masqueraded name and started it from PowerShell to gain covert remote control of compromised hosts.

Suspicious PowerShell Download from Public Content Hosting via BlindEagle

This rule detects PowerShell referencing public content-hosting services such as Pastebin, GitHub raw, and Discord CDN, which BlindEagle abuses to stage and retrieve its next-stage RAT payloads. Combining the PowerShell interpreter with these delivery domains distinguishes malicious retrieval from ordinary browsing and merits review.

Malicious Akira Shadow Copy Deletion via PowerShell WMI (via process_creation)

This rule detects PowerShell enumerating and deleting Volume Shadow Copies through WMI. Akira ransomware runs a PowerShell one-liner that queries Win32_Shadowcopy and calls Delete to remove backups before encryption, so this command indicates inhibition of system recovery during a ransomware attack.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Malicious Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell querying Win32_Shadowcopy through WMI and deleting the returned shadow copies, an alternative recovery-inhibition technique that avoids the vssadmin binary. It is associated with REvil ransomware-as-a-service affiliate operations seeking to destroy backups prior to encryption. Detecting the WMI-based variant closes a common evasion gap around shadow copy deletion.

Malicious Shadow Copy Deletion via WMI PowerShell (via ps_script)

This rule detects PowerShell that queries the Win32_Shadowcopy WMI class and then deletes the returned instances. Ransomware uses this WMI approach to remove Volume Shadow Copies without invoking vssadmin, evading command-line detections focused on that utility. Scripted shadow copy destruction through WMI is a clear recovery-inhibition behavior.

Suspicious PowerShell Remote File Download Cmdlets (via ps_script)

This rule detects PowerShell script blocks that invoke remote download primitives such as Invoke-WebRequest, Start-BitsTransfer or the WebClient DownloadFile method. The BadPilot campaign uses these cmdlets to retrieve additional payloads, so their presence in script telemetry points to ingress tool transfer during intrusion.

Suspicious PowerShell Encoded Command Execution

This rule detects powershell.exe or pwsh.exe launched with an EncodedCommand argument, an obfuscation technique used to hide the actual command from simple string matching and log inspection. Encoded PowerShell is a frequent component of maldoc and post-exploitation chains highlighted in threat hunting hypotheses. While some administrative tooling uses encoded commands, their presence warrants decoding and review.

Suspicious Microsoft Word Spawning PowerShell

This rule detects WINWORD.exe launching PowerShell, the macro-enabled document execution chain used by the profiled APT actors for initial access. A weaponized document spawning a scripting engine indicates the user enabled malicious content. Office applications have no legitimate reason to invoke PowerShell.

Suspicious PowerShell Download Cradle Writing Executable To Windows Temp

This rule detects a PowerShell process bypassing execution policy and using Invoke-WebRequest to save an executable into the Windows Temp directory. Initial access brokers use this cradle to stage tooling on freshly compromised hosts before handing off access. Writing a remote binary into a world-writable temp path and running it is a common first-stage foothold.

Malicious Office Application Spawning PowerShell with Encoded Command

This rule detects a Microsoft Office application such as winword.exe or excel.exe spawning cmd.exe or powershell.exe with an EncodedCommand argument, a hallmark of malicious document execution delivering an obfuscated payload. Office productivity apps do not normally launch encoded PowerShell. This parent-child chain indicates user-driven macro or exploit execution leading to code execution.

Malicious PowerShell Spawned by File Explorer via FileFix Social Engineering (via process_creation)

This rule detects explorer.exe launching PowerShell, which occurs when a user pastes a disguised command into the File Explorer address bar under the FileFix social engineering technique. Attackers trick victims into executing this command to download and run an Interlock RAT or infostealer payload.

Suspicious Shadow Copy Deletion via WMIC or PowerShell (via process_creation)

This rule detects deletion of Volume Shadow Copies via wmic or PowerShell referencing the shadowcopy class with a delete operation. VanHelsing removes shadow copies before encryption to inhibit recovery, so this command pattern flags pre-ransomware impact activity.

Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques

This rule detects PowerShell launched with an encoded command argument, an obfuscation technique used in trending Chinese APT operations to hide malicious script content. Attackers pass Base64-encoded commands to evade command-line inspection, so encoded PowerShell invocations are a common defense-evasion behavior that benefits from execution review.