Add APT36/SideCopy detection rules: CrimsonRAT persistence, XenoRAT task, mshta index.php chain

[Pyhroff]

Summary

Three new experimental rules covering APT36 (Transparent Tribe) / SideCopy TTPs with no prior Sigma coverage. This Pakistan-linked threat cluster has been consistently targeting Indian and Afghan government/defence networks, with campaigns escalating through 2025–2026 (Operation XENOFISCAL, cross-platform RAT campaign).

Rules added

File	What it detects	ATT&CK
registry_set_apt36_sidecopy_persistence.yml	CrimsonRAT (\Software\CrimsonRAT), ElizaRAT (\SYSTEM\ElizaRAT\Persistence), CapraStart run key	T1547.001
proc_creation_win_apt_sidecopy_xenorat_schtask.yml	schtasks.exe creating the hardcoded XenoUpdateManager task used to persist XenoRAT	T1053.005
proc_creation_win_apt_sidecopy_mshta_index_php.yml	mshta.exe fetching a remote HTA via an index.php endpoint — SideCopy signature TTP since 2019	T1218.005, T1566.001

Why these are not duplicates

• The existing proc_creation_win_mshta_http.yml detects any http:// / https:// URL in mshta commandlines. The new rule is more specific: it requires index.php in the path, which is the hardcoded endpoint pattern SideCopy uses on compromised PHP servers and reduces analyst fatigue on generic mshta-HTTP noise.
• No existing Sigma rules reference APT36, SideCopy, CrimsonRAT, ElizaRAT, or XenoRAT.

References

• https://www.seqrite.com/blog/operation-xenofiscal-sidecopy-deploying-persistent-xenorat-targeting-the-mof-afghanistan/
• https://thehackernews.com/2026/06/pakistan-linked-sidecopy-targets.html
• https://thehackernews.com/2026/02/apt36-and-sidecopy-launch-cross.html
• https://blog.talosintelligence.com/sidecopy/
• https://socprime.com/active-threats/operation-xenofiscal-sidecopy-deploys-persistent-xenorat-against-afghanistans-ministry-of-finance/
• https://arxiv.org/html/2510.04118v1 (Cyber Warfare During Operation Sindoor — detection framework)

False positive notes

• Registry rule: no known legitimate software writes to \Software\CrimsonRAT, \SYSTEM\ElizaRAT\Persistence, or \Run\CapraStart.
• XenoUpdateManager task: no legitimate software creates a scheduled task with this exact name.
• mshta index.php: mshta.exe loading remote PHP endpoints is not a pattern used by any known benign software.

[github-actions]

Welcome @Pyhroff 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server