Winnti Pipemon Malware Process Characteristics

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•21

Detects specific command-line characteristics associated with the Winnti Pipemon malware, as reported by ESET. The rule looks for `setup0.exe -p` or `setup.exe` with command-line arguments ending in `-x:0`, `-x:1`, or `-x:2`.