huntrule

Malicious WmRAT Persistence via vcswin Run Key (via registry_set)

PremiumReviewedSigma · High · v1
Product
windows
Category
registry_set
Author
HuntRule
Published
2026-09-16
Updated
2026-09-16
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a Run key value pointing to vcswin.exe, the persistence executable Bitter APT dropped in ProgramData to relaunch WmRAT at logon. The autostart entry references an attacker-staged binary rather than a legitimate application. A Run value pointing to vcswin.exe is a strong persistence indicator.

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Malicious PlugX Persistence via LMIGuardian Update Run Key (via registry_set)
Malicious axios NPM Supply Chain Persistence via MicrosoftUpdate Run Key
Malicious Registry Run Key Persistence Masquerading as MicrosoftUpdate
Malicious Run Key Persistence Referencing DLL in User Documents
PlugX Persistence via Run Key Named AAM Updatevlm
Suspicious Autorun Registry Persistence via sausageLoop Run Key
Malicious BabyLockerKZ Run Key Persistence
Suspicious Run Key Persistence Pointing To User-Writable Path
Malicious Ctrlpanel Run Key Autostart Persistence (via registry_set)
Malicious WmRAT Persistence via vcswin Run Key (via registry_set)
Pivot detection · T1547.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.