Sigma detection rules, expert-reviewed

DSRM Password Changed - Reg via PowerShell (via powershell)

This rule detects reset or synchronize with another domain account the DSRM (Directory Services Restore Mode) password in order to escalate privileges.

Suspicious PowerShell Indirect Execution via Get-Command

This rule detects PowerShell using Get-Command together with the call operator to resolve and invoke a cmdlet indirectly which the Gamaredon LNK delivery chain uses to obscure calls to Invoke-Expression and evade command line based detection. Piping or passing Get-Command output into an invocation operator is an obfuscation pattern rarely seen in legitimate scripts.

Scheduled Task Creating Per-Minute Hidden PowerShell Execution

This rule detects schtasks creating a task that runs at a one-minute interval and launches a hidden PowerShell script. The GPU miner campaign registered a scheduled task firing every minute to run hidden powershell against cor.ps1 or core.ps1 for persistence and re-infection. A minute-cadence hidden PowerShell task is a strong indicator of automated malware persistence.

Malicious ClickFix PowerShell DownloadFile Loader with Hidden Window

This rule detects a hidden-window PowerShell process using DownloadFile to fetch a script from a remote host, the NetSupport RAT ClickFix loader pattern. Victims pasted a command that ran PowerShell with hidden window and no-profile flags to download and then execute a follow-on .ps1 payload. Hidden PowerShell combined with a remote file download is a classic first-stage loader behavior.

Enable WDigest using PowerShell

Rule to detect registry modifications to enable WDigest using powershell over the commandline.

Malicious PowerShell Download Cradle via Invoke-WebRequest and IEX

This rule detects PowerShell run with an execution policy bypass that downloads content and pipes it directly to Invoke-Expression. Stealerium uses powershell -eP Bypass with Invoke-WebRequest to pull an atom feed from a blogspot dead drop and execute it in memory with IEX. This download-and-execute cradle is a widely abused fileless staging technique.

Suspicious Silent MSI Installation from AppData Spawned by PowerShell (via process_creation)

This rule detects msiexec.exe spawned by PowerShell to silently install an MSI staged in the user AppData directory, the second step of the Bumblebee loader chain where PowerShell writes y.msi to AppData and installs it with no user interaction. Legitimate software rarely installs MSIs from AppData under a PowerShell parent, so this parent-child and path combination surfaces the loader stage.

Malicious PowerShell IEX DownloadString One-Liner

This rule detects PowerShell using Invoke-Expression together with a WebClient DownloadString call to fetch and run remote code in memory. This one-liner is delivered through the Win+R fake CAPTCHA lure used to distribute Lumma Stealer. Catching the fetch-and-execute pattern flags fileless staging before the stealer touches disk.

Suspicious Credential Store Access for WinSCP and PuTTY via PowerShell (via ps_script)

This rule detects PowerShell script content referencing WinSCP and PuTTY session registry stores or the Windows Credential Manager enumeration API, the credential theft behavior of the SEO poisoning infostealer. These paths and calls harvest saved SSH, SFTP and enterprise credentials. Scripts touching these secrets stores are a strong credential access indicator.

OpenSSH Server Firewall Configuration on Windows - PowerShell (via powershell)

This rule detects configure the Windows firewall to allow incoming connections to perform stealthy lateral movement.

Malicious AMSI Bypass via PowerShell Reflection (via ps_script)

This rule detects PowerShell attempting to disable the Antimalware Scan Interface by patching AmsiUtils fields such as amsiInitFailed. The ClearFake variant runs an AMSI bypass before decrypting its AES payload so in-memory scanning is suppressed. Manipulating AMSI internals from a script is a strong signal of malicious execution.

Suspicious Veeam Backup Credential Harvesting via PowerShell (via ps_script)

This rule detects PowerShell activity that extracts and decrypts stored credentials from a Veeam backup server database. Abyss Locker operators ran an obfuscated variant of a public Veeam credential dumping script to recover accounts for lateral movement before deploying ransomware. Legitimate use of such scripts against production backup servers is uncommon.

Malicious Windows Defender Exclusion Added for PowerShell and conhost

This rule detects Add-MpPreference being used to register Windows Defender process exclusions for powershell or conhost. The ClipBanker campaign distributed through a trojanized Proxifier excluded its own living-off-the-land binaries from Defender scanning to run undetected as reported by Kaspersky. Adding process exclusions for these interpreters is a strong defense-evasion signal that precedes payload execution.

PowerShell Spawned by Headless Conhost (via process_creation)

This rule detects powershell.exe launched as a child of conhost.exe running with the --headless argument, a hidden-console execution pattern used in the PureRAT infection chain to run a covert download command. Adversaries leverage headless conhost to hide interactive console activity from the user, making this uncommon parent-child pairing a useful signal of scripted payload staging.

Suspicious Entra Agent Service Principal Sign-In With PowerShell User Agent via Sign-In Logs

This rule detects a service principal sign-in using a PowerShell user agent against Entra Agent ID identities, a pattern of automated credential misuse where an attacker authenticates as an AI agent through scripted Graph calls. Because assigned agents normally authenticate through their own runtime rather than interactive PowerShell tooling, this user agent on service principal sign-ins indicates hands-on-keyboard abuse of agent credentials.