Sigma detection rules, expert-reviewed

Malicious PowerShell Exfiltration to webhook.site Following WSUS Exploitation

This rule detects PowerShell using Invoke-WebRequest to PUT data to the webhook.site service, the exfiltration channel observed after Windows Server Update Services remote code execution. Attackers stage discovery output and upload it to a disposable webhook endpoint for collection. Outbound PUT requests to webhook.site from PowerShell are a strong exfiltration indicator.

Suspicious Script Host Spawning PowerShell via BlindEagle Chain

This rule detects a Windows Script Host process (wscript or cscript) spawning PowerShell, the execution chain used by BlindEagle after its VBS downloader retrieves remote payloads. This VBS-to-PowerShell handoff drives multi-stage RAT delivery such as njRAT and AsyncRAT, so the pattern is a strong early indicator of the infection.

PowerShell Base64 Download Cradle via FromBase64String and Invoke-Expression (via ps_script)

This rule detects PowerShell that decodes a base64 blob with FromBase64String and immediately runs it through Invoke-Expression, the staged download-and-execute cradle used by the LNK phishing chains analyzed by STRT to fetch and launch a second-stage script. Adversaries leverage this pattern to reconstruct and execute obfuscated code in memory, so this behavior warrants review during phishing investigation.

Malicious LSB Steganography Image Decoding via PowerShell (via ps_script)

This rule detects PowerShell loading an image as a bitmap and iterating pixel values to extract an embedded payload. The Caminho loader used a GetPixel loop over a downloaded image to decode a hidden .NET assembly for fileless execution.

Suspicious Script Host Spawning PowerShell Or Cmd via Gootloader

This rule detects wscript.exe or cscript.exe launching PowerShell or cmd, matching the Gootloader chain where a malicious .JS extracted from a ZIP hands off to a shell. Gootloader delivers this JavaScript through SEO-poisoned search results posing as document templates. A Windows script host spawning a command interpreter is rarely benign on endpoints.

Suspicious PowerShell Console Window Hiding via ShowWindow

This rule detects PowerShell resolving GetConsoleWindow and calling ShowWindow to hide its own console, a stealth technique in the fake AI-tool installer chain that also re-executes itself for UAC. Hiding the window keeps the malicious script invisible to the user while it stages ransomware components in the background.

Suspicious Reflective Assembly Load in PowerShell (via ps_script)

This rule detects PowerShell script content that reflectively loads a .NET assembly directly from a base64-decoded byte array. This in-memory loading technique was observed in the SHADOW#REACTOR campaign to execute a .NET Reactor protected loader.

Suspicious PowerShell Invoking Remote HTA via Environment Variable Masquerading (via process_creation)

This rule detects PowerShell command lines that reference an environment-variable path together with a remote HTA URL. The CMSTP LNK loader uses this masquerading technique to launch mshta against attacker infrastructure.

Suspicious PythonLauncher Scheduled Task Creation via PowerShell Script

This rule detects PowerShell creating a scheduled task named with the PythonLauncher prefix, the logon persistence UAT-11795 registers for its Starland RAT as reported by Cisco Talos. The operators combine New-ScheduledTask with a PythonLauncher task name to relaunch the implant elevated at each logon. Matching this naming and API pattern reveals attacker persistence distinct from routine task creation.

Suspicious Node.js Spawning PowerShell Archive Download to Temp

This rule detects a Node.js process spawning PowerShell to download a compressed archive into the user temp directory, a chain seen when a malicious npm postinstall hook stages a payload. In the MUT-4831 campaign node.exe launched PowerShell to retrieve a zip that unpacked the Vidar infostealer. This process lineage is unusual for legitimate development workflows and points to supply chain compromise.

Suspicious PowerShell Payload Download via Invoke-WebRequest to status.php

This rule detects obfuscated PowerShell using Invoke-WebRequest to pull a payload from a status php endpoint. Fake IT support pages delivering Vidar staged the next stage through this download pattern. Scripted retrieval of remote executables from a status php gateway is a common loader beacon and delivery mechanism.

Suspicious PowerShell COM-Based Script Execution and HTTP Retrieval (via ps_script)

This rule detects PowerShell script content that instantiates the MSScriptControl COM object alongside ServerXMLHTTP for command retrieval. The STEADY#URSA SUBTLE-PAWS backdoor used this combination to fetch and run C2 commands.

BitLocker Feature Installation via ServerManagerCmd or PowerShell (via process_creation)

This rule detects on-demand installation of the BitLocker Windows feature through ServerManagerCmd or Install-WindowsFeature, the enabling step ShrinkLocker performs on systems where BitLocker is absent before hijacking it to encrypt drives. Adversaries leverage the native BitLocker feature to lock victim data without dropping a custom encryptor, so this behavior warrants review on hosts where BitLocker deployment is unexpected.

Malicious Forfiles Proxy Execution Launching PowerShell and MSHTA in PEAKLIGHT Chain (via process_creation)

This rule detects forfiles.exe enumerating win.ini and using its command flag to launch PowerShell and mshta, matching the PEAKLIGHT LNK-driven infection chain that abuses forfiles as a proxy execution binary. This technique launches a memory-only downloader while evading direct process lineage detection.

Malicious PowerShell Spawned by IIS Worker Process via OWASSRF Exchange Exploitation (via process_creation)

This rule detects the IIS worker process w3wp.exe spawning PowerShell, a post-exploitation pattern seen in the OWASSRF exploitation of Exchange CVE-2022-41080 and CVE-2022-41082 through Outlook Web Access. Attackers use this server-side execution to run reconnaissance and drop tooling after bypassing ProxyNotShell mitigations, so PowerShell descended from an Exchange web process is a strong compromise signal.