Potential Winnti Dropper Activity

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•20

Detects specific filenames associated with Winnti dropper activity, as detailed in the RedMimicry Winnti playbook. The rule looks for the creation or modification of 'gthread-3.6.dll', 'sigcmm-2.4.dll', or 'Windows\Temp\tmp.bat', which are known indicators of compromise for Winnti malware.