Sigma detection rules, expert-reviewed

Suspicious FatalRAT C2 HTTP Initial Submission Request (via proxy)

This rule detects the FatalRAT command-and-control check-in, an HTTP GET to the initialsubmission path carrying windows_version and computer_name query parameters. This beacon pattern was observed in Operation SalmonSlalom against Chinese-speaking APAC targets. Detecting the structured check-in URI exposes active C2 communication from an infected host.

Suspicious Service Creation Hosting Binary via Svchost (via process_creation)

This rule detects sc.exe creating a service whose binary path launches svchost.exe with the -k grouping switch. This behavior was observed in the updated MATA framework attacking industrial companies to register a malicious service DLL under a svchost service group for persistence. Detecting the service registration exposes the persistence and privilege-context stage.

Suspicious Masqueraded Exfiltration Utility AuditSvc Execution (via process_creation)

This rule detects execution of AuditSvc.exe, a name used to masquerade a data-upload tool that transfers staged archives to file-sharing services. This behavior was observed in attacks against industrial organizations that renamed transfer utilities to blend in as legitimate services. Flagging the masqueraded binary surfaces the exfiltration stage of the intrusion.

Suspicious Command Output Redirection to Windows Debug Out File (via process_creation)

This rule detects command execution that redirects output to the hardcoded C\Windows\debug\out.txt file. This behavior was observed in attacks against industrial organizations where second-stage commands capture their results to a fixed file under the Windows debug directory for later collection. Detecting this reveals hands-on-keyboard reconnaissance and output staging.

Suspicious Archive Staging to ProgramData NetWorks Path via RAR (via process_creation)

This rule detects RAR being used to archive collected files into the hardcoded C\ProgramData\NetWorks\ZZ staging directory. This behavior was observed in attacks against industrial organizations that deploy data-upload implants and archive victim data before exfiltration. Catching the local staging stage exposes collection before data leaves the network.

Suspicious RemCom Service Named Pipe for Lateral Movement (via pipe_created)

This rule detects creation of a RemCom named pipe used by the open-source PsExec-style RemCom service to relay stdin, stdout, and control channels for remote execution. This behavior was observed in Cyber Partisans activity that used RemCom for lateral movement across industrial networks. Detecting the pipe exposes remote service execution between hosts.

Malicious APT-C-60 COM Hijack via CLSID 566296fe InProcServer32 (via registry_set)

This rule detects modification of the InProcServer32 value for CLSID 566296fe-e0e8-475f-ba9c-a31ad31620b1 under HKCU, the COM hijack used by APT-C-60 in its updated campaign to load a downloader DLL. Redirecting this class identifier to a malicious in-process server delivers stealthy per-user persistence and execution.

Suspicious git.exe Proxy Execution of Script Payload in APT-C-60 2026 Chain (via process_creation)

This rule detects the legitimate git.exe being used to execute an attacker-supplied script rather than perform a repository operation, the living-off-the-land step in APT-C-60's 2026 SpyGlace delivery chain. Proxying execution through a signed git binary evades binary allowlisting while running the downloader stage.

Suspicious mshta.exe Executing Embedded JavaScript from LNK Chain (via process_creation)

This rule detects mshta.exe executing inline JavaScript, the second-stage execution used by APT-C-60 in its 2026 campaign where a RAR-delivered LNK invokes mshta to run embedded script and fetch remote payloads. Abusing the trusted HTML application host to run script proxies execution and evades application controls.

Suspicious Cryptomining Shell Script Execution sex.sh or miner.sh on Linux (via process_creation)

This rule detects execution of the sex.sh or miner.sh scripts dropped by threat actors after exploiting React2Shell on Linux to deploy a cryptominer. Running these named installer scripts indicates resource-hijacking activity for financial gain on the compromised host.

Malicious Global Socket gs-netcat Reverse Shell over DNS Port (via process_creation)

This rule detects execution using the Global Socket relay with GS_PORT set to 53 and interactive listener arguments loading npm-cli.dat, the covert channel established by actors exploiting React2Shell on Linux. Tunneling a reverse shell over the DNS port through the Global Socket relay is used to bypass egress filtering and hide C2 traffic.

Malicious Cron Execution of Binary from tmp Directory on Linux (via process_creation)

This rule detects cron launching an executable located under /tmp such as /tmp/kernal, the minute-interval persistence used by threat actors exploiting React2Shell (CVE-2025-55182) on Linux hosts. Scheduling a world-writable /tmp binary via cron provides resilient re-execution of dropped backdoors after post-exploitation.

PowerShell ExportedCommands Array Index for Indirect Cmdlet Execution (Windows Process Creation)

Flags PowerShell command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke them via array index.

Obfuscated PowerShell Script: Indirect Cmdlet Execution via ExportedCommands Array Index

Flags obfuscated PowerShell scripts that enumerate ExportedCommands and invoke them indirectly using array indexing.

Suspicious Masqueraded DAT File Loader Chain in Loader Stage (via process_creation)

This rule detects command lines referencing the SecureBootUEFI.dat, Service.dat, cn.dat or sp.dat staging files used by APT-C-60 in the SpyGlace deployment chain. These .dat-named artifacts are sequentially decoded loaders masquerading as data files to conceal the final backdoor payload.