Sigma detection rules, expert-reviewed

Suspicious RemCom Service Named Pipe for Lateral Movement (via pipe_created)

This rule detects creation of a RemCom named pipe used by the open-source PsExec-style RemCom service to relay stdin, stdout, and control channels for remote execution. This behavior was observed in Cyber Partisans activity that used RemCom for lateral movement across industrial networks. Detecting the pipe exposes remote service execution between hosts.

Malicious APT-C-60 COM Hijack via CLSID 566296fe InProcServer32 (via registry_set)

This rule detects modification of the InProcServer32 value for CLSID 566296fe-e0e8-475f-ba9c-a31ad31620b1 under HKCU, the COM hijack used by APT-C-60 in its updated campaign to load a downloader DLL. Redirecting this class identifier to a malicious in-process server delivers stealthy per-user persistence and execution.

Suspicious git.exe Proxy Execution of Script Payload in APT-C-60 2026 Chain (via process_creation)

This rule detects the legitimate git.exe being used to execute an attacker-supplied script rather than perform a repository operation, the living-off-the-land step in APT-C-60's 2026 SpyGlace delivery chain. Proxying execution through a signed git binary evades binary allowlisting while running the downloader stage.

Suspicious mshta.exe Executing Embedded JavaScript from LNK Chain (via process_creation)

This rule detects mshta.exe executing inline JavaScript, the second-stage execution used by APT-C-60 in its 2026 campaign where a RAR-delivered LNK invokes mshta to run embedded script and fetch remote payloads. Abusing the trusted HTML application host to run script proxies execution and evades application controls.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Suspicious Masqueraded DAT File Loader Chain in Loader Stage (via process_creation)

This rule detects command lines referencing the SecureBootUEFI.dat, Service.dat, cn.dat or sp.dat staging files used by APT-C-60 in the SpyGlace deployment chain. These .dat-named artifacts are sequentially decoded loaders masquerading as data files to conceal the final backdoor payload.

Suspicious git.exe Executing Non-Repository Script Payload (via process_creation)

This rule detects the legitimate git.exe being used to execute an unrelated script or data file such as IPML.txt, the living-off-the-land technique used by APT-C-60 to run the SpyGlace loader chain. Abusing a signed git binary as an execution proxy lets the actor run staged payloads while evading binary-based controls.

Suspicious MSBuild Execution of Inline Payload (via process_creation)

This rule detects execution of MSBuild.exe, the trusted developer utility abused by MirrorFace to compile and run malicious inline tasks from XML project files. Attackers use MSBuild as a trusted proxy to execute code and evade application controls outside of a normal build pipeline.

Suspicious Service ACL Hardening via sc.exe sdset (via process_creation)

This rule detects use of sc.exe with the sdset argument to rewrite a service security descriptor, a defense-evasion step used by MirrorFace to harden the ACL of its NOOPDOOR service against inspection and removal. Restricting service access via SDDL is used to protect malicious persistence from defenders.

Suspicious VBScript Persistence in CurrentVersion Run Key

This rule detects a CurrentVersion Run autorun value whose data references a script interpreter or inline VBScript, a persistence technique in which adversaries register a scripting payload to execute at logon. Storing wscript, mshta or vbscript logic in a Run key lets fileless or lightly obfuscated code survive reboots. Legitimate autorun entries rarely embed script keywords of this kind.

Suspicious VBScript Code Stored in CurrentVersion Registry Value

This rule detects registry values written under a CurrentVersion key that carry VBScript or scripting-object keywords such as Execute, Shell.Application or CreateObject. Adversaries including Nobelium via the Sibot malware hide executable script inside registry values to evade file-based detection and later run it through a script interpreter or rundll32. Storing script logic in registry data is unusual for legitimate software and indicates fileless staging.

Suspicious Remote Desktop Enablement via Registry By Ransomware

This rule detects the registry change that clears fDenyTSConnections to enable inbound RDP on a host. The Qilin ransomware group flips this key to open a Terminal Server access path for lateral movement. Enabling RDP on a workstation that normally has it disabled is a strong pre-encryption footprint.

Suspicious VBScript Payload Stored in CurrentVersion Registry Value (via registry_set)

This rule detects registry values written under HKCU or HKLM CurrentVersion that contain VBScript execution keywords such as Execute, vbscript or Shell.Application. Actors including Nobelium stash script payloads in non-Run CurrentVersion values to hide fileless persistence outside the commonly scrutinized Run subkeys.

Suspicious Browser Extension Force-Install via Registry (via registry_set)

This rule detects registry writes to the browser ExtensionInstallForcelist policy that silently force-install an extension into Chrome or Edge. PrivateLoader pushes unwanted extensions this way so the browser loads attacker code without user consent. Programmatic force-install entries are a stealthy persistence and monetization mechanism worth reviewing.