Welcome to Episode 2 of The Threat Hunter’s Notepad!
In today’s episode, we are tackling a massive blind spot that is costing organizations millions. In December 2025, threat actors like Storm-0249 escalated their ransomware operations using fileless PowerShell execution. They used legitimate Windows utilities to fetch and run scripts without ever touching the disk, leaving security teams completely unaware until the damage was already done.
The data behind this threat is staggering. Currently, 49% of cyberattacks use PowerShell somewhere in the attack chain, and 77% of successful attacks involve fileless malware. Because PowerShell is a legitimate, Microsoft-signed tool used daily by system administrators, traditional antivirus cannot just block it. Security products usually try to whitelist it entirely or alert on every single execution, which creates so much noise that SOC teams just tune it out. The result is that attackers can operate undetected inside networks for an average of 292 days—almost a full year.
What You’ll Hear in This Episode:
The APT29 Telemetry Analysis: We break down Detection Engineer Manish Rawat’s analysis of 196,071 Sysmon events from the MITRE ATT&CK APT29 dataset to see how advanced adversaries actually operate.
The Four Malicious Patterns: We explain why you need to stop relying on simple string matching and start hunting for behavioral combinations. We cover how attackers use encoding (like Base64 and
-encflags), leverage Office apps like Excel and Word to spawn PowerShell, rely on standard evasion flags (-NoProfile,-window hidden,-ep bypass), and make network connections with built-in cmdlets likeInvoke-WebRequest.Building a Rule That Actually Works: We discuss the custom Sigma rule designed to catch these specific malicious combinations by correlating parent processes with network activity and evasion flags.
Cutting the Noise: We explore how looking for suspicious process chains (like
cmd.exespawningcontrol.exe, which then spawns PowerShell) can reduce the noise from 10,000 generic alerts down to just 5 to 10 high-confidence, actionable alerts per day.
PowerShell abuse is not going away, and the next attack is likely already running in someone’s environment right now. Hit play on the audio above to learn how to catch fileless attacks at the initial staging phase, before the adversary establishes persistence.
Resources Mentioned:
GitHub Release: The complete, production-ready Sigma rule, along with the Splunk SPL conversion, is available on Manish Rawat’s GitHub repository.
MITRE ATT&CK Mappings: This rule provides coverage across the attack lifecycle, mapping directly to techniques T1059.001 (PowerShell), T1027 (Obfuscation), and T1566.001 (Spearphishing Attachment).
Connect: You can follow Manish Rawat’s ongoing threat hunting research on LinkedIn.
(Grab your notepad, tune in, and let’s start hunting. The blue team gets stronger when we share our work!)
