RedMimicry Winnti Playbook Registry Manipulation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•14

Detects modifications to the 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data' registry key, which is associated with the RedMimicry Winnti playbook. This registry key can be used for persistence or defense evasion by adversaries.