Sigma detection rules, expert-reviewed

Malicious PowerShell Runtime Loaded Outside PowerShell Host

This rule detects the System.Management.Automation.dll PowerShell runtime being loaded by a process other than a legitimate PowerShell host, the unmanaged PowerShell technique used by Cobalt Strike to execute PowerShell in memory without spawning powershell.exe. Running PowerShell inside an arbitrary process evades monitoring that watches the PowerShell binary. A non-host process loading the automation assembly is a strong injection indicator.

Malicious Credential Stealer PowerShell Script Names Targeting Financial Services

This rule detects execution of PowerShell stealer scripts named for financial and cryptocurrency services such as secure.chase.ps1, qb_check.ps1 and coinbase_check.ps1 observed in the reviewed intrusions harvesting banking and wallet credentials. These distinctive script names encode the targeted brand and are stable indicators of the stealer tooling. Their appearance in command lines or script block logs indicates active credential access against financial accounts.

Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent

This rule detects PowerShell using Get-WinEvent to harvest Terminal Services event ID 1149, which records successful RDP authentications, as seen in the r.ps1 script from a Qilin ransomware attack. Attackers mine these events to identify prior remote access sources and valid accounts for lateral movement. Bulk collection of RDP logon events is uncommon outside of forensic tooling.

Malicious Volume Shadow Copy Deletion via WMI PowerShell

This rule detects PowerShell that enumerates Win32_Shadowcopy objects and pipes them to Remove-WmiObject to destroy volume shadow copies, an inhibit-recovery step preceding encryption. This behavior was observed in RMM-enabled intrusions leading to Akira ransomware. Removing shadow copies denies victims local recovery and signals imminent ransomware detonation.

PowerShell Local Account Creation With Self-Deleting Script

This rule detects a PowerShell script that creates a local user account and then removes itself from disk, a persistence-with-cleanup pattern observed during MSSQL server intrusions. Huntress recovered a user.ps1 that invoked New-LocalUser before deleting its own file. Combining account creation with self-deletion indicates covert backdoor account provisioning rather than routine administration.

Suspicious PowerShell Web Request to oastify Out-of-Band Domain

This rule detects PowerShell issuing a web request to an oastify.com domain, matching out-of-band interaction and tool retrieval observed after SQL injection compromise. The oastify.com domain is used for out-of-band application security testing callbacks and is abused by intruders to confirm code execution and pull payloads. PowerShell contacting this domain indicates active exploitation.

Suspicious PowerShell Execution of Untitled1 Script From ProgramData

This rule detects PowerShell executing a script named Untitled1.ps1 from the ProgramData directory, matching the vibe-coded Active Directory enumeration tool analyzed by Huntress. The default editor script name dropped into a world-writable path is used to run domain reconnaissance. Execution of this named script from ProgramData indicates hands-on-keyboard enumeration.

Suspicious PowerShell Spawned by Komari Monitoring Agent

This rule detects the komari-agent binary spawning PowerShell, the built-in reverse shell behavior of the Komari monitoring tool abused in a Huntress-investigated intrusion. The agent was installed as a NSSM service masquerading as Windows Update Service and used its embedded shell for command execution. A monitoring agent launching an interactive interpreter reflects abuse of its reverse shell capability.

Malicious Volume Shadow Copy Deletion via PowerShell Child Process via process_creation

This rule detects PowerShell spawning vssadmin, wmic, or WMI calls that delete volume shadow copies. NightSpire ransomware used a PowerShell child process to remove shadow copies and inhibit recovery before encryption, so this behavior is a high-confidence precursor to ransomware impact.

Suspicious Scheduled Task Recovery Diagnostics Running PowerShell Script via process_creation

This rule detects schtasks.exe creating a scheduled task named Recovery Diagnostics that executes a new.ps1 script under the SYSTEM context. The threat actor used this task to run their PowerShell tooling with elevated privileges under a benign maintenance name, establishing persistence ahead of data exfiltration and ransomware deployment.

Malicious PowerShell Download of vhost.exe Payload

This rule detects PowerShell retrieving a payload named vhost.exe over the network, the ingress tool transfer observed in the SimpleHelp abuse ransomware operation preceding encryption. The actor used PowerShell download cradles to pull the next-stage binary onto compromised hosts. A scripting host fetching this named executable indicates active staging of ransomware tooling.

Suspicious PowerShell Spawned by ScreenConnect Remote Access Client

This rule detects PowerShell being launched as a child of the ScreenConnect remote access client, a lineage observed where actors abused legitimate RMM tooling to run follow-on scripts. While ScreenConnect is widely used for support, a scripting host spawned from its agent is a frequent hands-on-keyboard delivery pattern and merits scrutiny in environments where it is not sanctioned. Correlate with the downstream script content to confirm intent.

Malicious PowerShell Download of conqueror.exe to Public Directory via Gladinet Exploitation

This rule detects PowerShell or curl downloading the second-stage payload conqueror.exe into C:\Users\Public during post-exploitation of the Gladinet CentreStack and Triofox vulnerability. The actors used Invoke-WebRequest and curl to stage the tool in a world-writable location for later execution. Retrieval of a named executable into a public path from a scripting host is a strong indicator of ingress tool transfer following server compromise.

Malicious mshta Spawning PowerShell Loader via ClickFix

This rule detects mshta.exe spawning PowerShell, the loader chain used by a ClickFix campaign that buries XOR-encoded shellcode in images before injecting into explorer.exe. The mshta stage decodes and launches PowerShell to deliver LummaC2 or Rhadamanthys stealers. mshta parenting PowerShell is a strong indicator of scripted malware execution.

Suspicious Velociraptor DFIR Agent Spawning Encoded PowerShell

This rule detects the Velociraptor DFIR agent spawning PowerShell with an encoded command, matching attacker misuse of Velociraptor running as LocalSystem to execute payloads following WSUS exploitation. Adversaries repurpose the legitimate incident response tool to run covert commands with high privilege. Velociraptor launching encoded PowerShell outside sanctioned hunts is anomalous.