Add HackTool - Gogo Scanner Execution Rule

[Aryu-RU]

Summary of the Pull Request

Adds a new process_creation rule detecting execution of gogo (chainreactors/gogo), an
open-source automated network scanning engine designed for red teams.

Coverage gap: gogo currently has no detection coverage anywhere in the Sigma ruleset (verified by
grepping the repo for gogo, chainreactors, and gogo_windows — zero matches). The existing
per-tool scanner rules (proc_creation_win_pua_netscan.yml, proc_creation_win_pua_nmap_zenmap.yml,
proc_creation_win_pua_nimscan.yml, proc_creation_win_pua_advanced_port_scanner.yml,
proc_creation_win_pua_advanced_ip_scanner.yml) cover other tools and would not fire on gogo, and
there is no generic "port-scanner" rule that would catch gogo's CLI behavior.

The rule mirrors the structure of the recently-merged HackTool - NetExec Execution
(proc_creation_win_hktl_netexec.yml): it anchors on the gogo binary name combined with
distinctive gogo-specific CLI tokens — the project's named port-preset tags (top1/top2/top3,
win, db, docker, oracle, dubbo, lotus), -m ss/-m sc "supersmart" scan modes, and
-P port/-P workflow config-listing commands. These tokens are documented in the official
chainreactors/gogo README and are specific to gogo's CLI. Gogo binaries are Go-built and do not
expose a PE OriginalFileName, so Image-suffix is the correct anchor (operators frequently rename
the binary, which is a known limitation of this approach — matches the NetExec rule's tradeoff).

In-the-wild reference: Cisco Talos's May 2026 report on the China-nexus APT group UAT-8302
documents the operators downloading gogo_windows_amd64.exe from the official GitHub releases for
internal network reconnaissance.

Validated locally with tests/test_rules.py, tests/test_logsource.py, yamllint, and
sigma check --validation-config tests/sigma_cli_conf.yml (0 errors, 0 issues).

Changelog

new: HackTool - Gogo Scanner Execution

Example Log Event

Not applicable — this PR adds a new detection rule, not a false-positive fix.

Fixed Issues

None.

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃