Sigma detection rules, expert-reviewed

Suspicious Windows Script Host Spawning PowerShell via Gootloader

This rule detects wscript.exe spawning PowerShell, the execution chain used by Gootloader after a user runs a malicious script delivered through SEO poisoning. The script host launches PowerShell to unpack and run the next stage in memory. Script host to PowerShell chains are uncommon in normal environments and warrant scrutiny.

Suspicious PowerShell Spawned by Web Browser

This rule detects PowerShell launched directly by a web browser process, an execution pattern seen when ClickFix lures drive victims to run pasted commands that establish Cloudflare tunnels or download payloads. This was observed across ClickFix variants. Browsers do not normally spawn PowerShell, so this parent-child relationship strongly indicates malicious execution.

Suspicious PowerShell Out-of-Band Request to Interactsh Domain

This rule detects PowerShell issuing a web request to Interactsh out-of-band domains such as oastify.com or oast.fun, used by attackers to confirm CVE-2025-30406 exploitation against Gladinet CentreStack as reported by Huntress. Adversaries trigger DNS or HTTP callbacks to validate code execution before deploying payloads. Outbound callbacks to out-of-band interaction services from PowerShell strongly indicate exploitation or reconnaissance.

Malicious IIS Worker Process Spawning PowerShell via Gladinet CentreStack Exploit

This rule detects the IIS worker process w3wp.exe spawning powershell.exe, a web-shell style execution chain observed by Huntress during exploitation of Gladinet CentreStack and Triofox CVE-2025-30406. Attackers leverage a hardcoded machine key ViewState deserialization flaw to run commands as the web application. Because a web worker launching PowerShell is rarely legitimate, this chain is a high-confidence server compromise indicator.

Suspicious Windows Defender Exclusion Added via PowerShell Add-MpPreference

This rule detects PowerShell using Add-MpPreference to register a Windows Defender exclusion, observed during post-exploitation of CrushFTP servers by Huntress. Attackers add path or process exclusions to prevent detection of tooling staged under directories such as Windows Temp. Disabling protection coverage before dropping payloads is a common defense-evasion precursor, so unexpected exclusion changes warrant review.

Suspicious Curl Download Spawned by PowerShell

This rule detects the curl client spawned as a child of PowerShell, an anomalous chain used to fetch second-stage tooling after an initial PowerShell foothold. Legitimate curl usage is rarely launched by an interactive PowerShell session. This process lineage indicates scripted download activity during post-exploitation.

Suspicious Event Log Clearing via PowerShell Invoke-Expression

This rule detects PowerShell clearing Windows event logs, used in the SysAid intrusion to remove traces of activity. Programmatic event log clearing is a strong indicator of anti-forensic defense evasion following a compromise.

Suspicious PowerShell Spawned by SysAid Java Process

This rule detects the SysAid Java process spawning PowerShell, the exploitation behavior of CVE-2023-47246 where a WAR webshell led to PowerShell execution. The SysAid application server launching PowerShell indicates remote code execution through the vulnerable service.

Suspicious File Download via PowerShell WebClient DownloadFile

This rule detects PowerShell downloading files with WebClient DownloadFile, used to retrieve an MSI and a malicious MSBuild XML in this campaign. This is a common ingress tool transfer method that, while occasionally used by administrators, frequently indicates payload staging.

Suspicious Encoded PowerShell DownloadString Execution

This rule detects PowerShell using encoded command flags or an in-memory WebClient DownloadString with Invoke-Expression, the loader behavior in the Confluence CVE-2023-22518 to Cerber ransomware chain. Encoded and download-and-execute PowerShell is a common obfuscated fileless delivery method preceding ransomware deployment.

Suspicious PowerShell Copy-Item Into ProgramData Logs by MuddyWater (via process_creation)

This rule detects PowerShell using Copy-Item to stage files into the C:\ProgramData\Logs directory, a technique MuddyWater uses to place malware components in a shared writable location. The unusual staging path combined with scripted copying points to malware setup rather than routine administration. Detecting it exposes early MuddyWater tooling deployment.

Suspicious Hidden PowerShell Download Cradle Used by DragonForce Ransomware (via process_creation)

This rule detects PowerShell executed with a hidden window that also invokes a remote download cradle, matching the DragonForce ransomware intrusion pattern for staging Cobalt Strike beacons. Operators use this to fetch second-stage payloads while evading user visibility. Early detection blocks the ransomware kill chain before encryption and lateral movement.

Malicious Shadow Copy Deletion via PowerShell Win32_ShadowCopy Remove-CimInstance (via process_creation)

This rule detects PowerShell deleting Volume Shadow Copies by pairing Get-CimInstance Win32_ShadowCopy with Remove-CimInstance, a recovery-inhibition command used by RansomHub per Group-IB. Adversaries remove shadow copies through CIM to block restoration before encryption, making this a strong pre-impact indicator.

Suspicious PowerShell Download Cradle via Invoke-WebRequest Piped to iex (via process_creation)

This rule detects a PowerShell download cradle that retrieves content with Invoke-WebRequest and executes it through iex, the secondary SMOKESABER stage in Group-IB ClickFix intrusions. Adversaries use this in-memory fetch-and-execute pattern to run remote scripts without touching disk, making it a reliable indicator of staged payload delivery.

Malicious LSASS Memory Dump via PowerShell

This rule detects PowerShell dumping the LSASS process memory to harvest credentials. During the Christmas Miracle incident the actor used PowerShell to create an LSASS memory dump for offline credential extraction. Access to LSASS memory yields plaintext and hashed credentials for lateral movement.