Sigma detection rules, expert-reviewed

Suspicious Obfuscated PowerShell Spawned by explorer via Run Dialog

This rule detects powershell launched directly by explorer with obfuscation indicators which matches the paste and run or ClickFix technique used by Mocha Manakin to trick users into pasting a malicious command into the Run dialog. This user driven execution delivers a NodeJS backdoor while bypassing many download based defenses. Detecting explorer spawned obfuscated PowerShell surfaces the initial foothold.

Suspicious PowerShell With Reversed HTTP String (via process_creation)

This rule detects PowerShell command lines containing the reversed HTTP string used to hide C2 URLs. This steganography spam campaign reverses download URLs before reconstructing them at runtime.

Malicious Konni PowerShell Loader Reading Script from ProgramData via Invoke-Expression (via process_creation)

This rule detects PowerShell launched with an execution policy bypass that reads a script from the ProgramData directory and runs it through Invoke-Expression, the loader behavior of a Konni AsyncRAT LNK infection that drops d.ps1 into ProgramData. Adversaries leverage Get-Content piped into Invoke-Expression to execute a staged script while hiding the payload from the command line, making early detection critical for catching the loader before AsyncRAT deploys.

Malicious Print Spooler Privilege Escalation via Printer Added - CVE-2020-1048 (via powershell)

This rule detects abuse the printer spooler features to load a DLL. The attack is composed by 4 steps > 1) create a printer that points to a missing DLL 2) print to that port 3) crash the printer spool 4) have his original DLL registered for privilege escalation.

Suspicious Encoded PowerShell Execution Following SharePoint Exploitation (via ps_script)

This rule detects PowerShell invoked with a base64 encoded command, used in ToolShell post-exploitation to stage payloads while obscuring intent. Encoded command execution on SharePoint servers exploiting CVE-2025-53770 indicates hands-on-keyboard activity following initial access.

DCOM Lateral Movement - Via MMC20 (via powershell)

This rule detects execute the Impacket DCOMexec tool in order to abuse DCOM services.

Malicious Volume Shadow Copy Deletion via WMI PowerShell (via process_creation)

This rule detects PowerShell querying the Win32_Shadowcopy WMI class and invoking a delete or remove operation to destroy volume shadow copies. Akira used this to inhibit system recovery before encryption. Removing shadow copies prevents victims from restoring files without paying the ransom.

Malicious Fileless PowerShell Registry Payload Execution via Process Creation

This rule detects hidden PowerShell that reads a payload from a registry value and pipes it to Invoke-Expression. StripedFly stores its encrypted loader under an HKCU Applets key and executes it fileless via hidden PowerShell with IEX, achieving stealthy in-memory execution.

PowerShell Command-Line Obfuscation Constructs (via process_creation)

This rule detects PowerShell command lines that use format-operator, character-array, backtick or string-reversal obfuscation to hide the real payload from simple string matching. Command obfuscation accompanies the heavy PowerShell abuse documented in the Red Canary Threat Detection Report, and these constructs are rarely produced by legitimate one-liners. Detecting the obfuscation syntax surfaces evasive script execution regardless of the ultimate payload.

Suspicious Hidden PowerShell Download and Archive Expansion

This rule detects hidden-window PowerShell that downloads content with Invoke-WebRequest and expands an archive in the same command. This chain was used to retrieve and unpack the XWorm loader, combining ingress tool transfer with a hidden window to evade user awareness.

Suspicious PowerShell Spawning wscript with Silent Flag (via process_creation)

This rule detects PowerShell launching wscript.exe with the silent background flag to run a JScript wrapper. This chain was observed in the JS#SMUGGLER campaign to execute the NetSupport RAT loader while suppressing script errors.

Suspicious Enabling of Network Discovery Firewall Rules via PowerShell

This rule detects enabling of the Network Discovery firewall rule group via PowerShell, the step The Gentlemen ransomware took to widen host visibility for lateral movement. Programmatically enabling network discovery firewall rules during an intrusion facilitates spread across the environment.

In-Memory Regasm Process Hollowing Spawned by PowerShell (via process_creation)

This rule detects the .NET Regasm.exe utility launched as a child of powershell.exe, the process-hollowing target used by 0bj3ctivityStealer to inject its final stealer payload. Adversaries leverage Regasm as a signed injection host that seldom runs from PowerShell, making this parent-child pairing a reliable indicator of code injection.

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

This rule detects python.exe spawned by PowerShell while referencing a remote WebDAV share path in its command line. The Voldemort espionage campaign ran Python directly from mounted TryCloudflare WebDAV shares to load its backdoor without local staging.

Suspicious Screen Capture via PowerShell Graphics API (via process_creation)

This rule detects PowerShell invoking the CopyFromScreen graphics method to grab the desktop, a screen-capture collection technique used to spy on a victim's session. Screen capture is tracked in the Red Canary Threat Detection Report. Detecting the graphics-API call surfaces surveillance of the user's screen.