Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
4
1
Categories
2
1
1
1
1
Platforms
5
1
Products / Services
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects specific process creation patterns associated with the Winnti malware campaign targeting Hong Kong universities in late 2019 and early 2020. The rule looks for suspicious parent-child process relationships and specific file paths used by the malware, such as executables under 'C:\Windows\Temp', 'C:\ProgramData\DRM', and 'C:\ProgramData\DRM\CLR'. It also identifies instances where legitimate applications like 'wmplayer.exe' or 'SearchFilterHost.exe' are launched from these suspicious directories or by suspicious parent processes.
KQL Query
Detects a DNS query to 'azurewebsites.net' originating from a process that is not a recognized web browser. Threat actors have frequently used 'azurewebsites.net' for malware hosting and data exfiltration. This rule aims to identify suspicious communication patterns where non-browser applications might be attempting to communicate with known malicious infrastructure hosted on Azure.
Detects specific filenames associated with Winnti dropper activity, as detailed in the RedMimicry Winnti playbook. The rule looks for the creation or modification of 'gthread-3.6.dll', 'sigcmm-2.4.dll', or 'Windows\Temp\tmp.bat', which are known indicators of compromise for Winnti malware.
Detects the execution of specific commands and DLLs associated with the RedMimicry Winnti playbook, an automated breach emulation utility. The rule looks for 'rundll32.exe' or 'cmd.exe' processes executing with command-line arguments containing 'gthread-3.6.dll', '\Windows\Temp\tmp.bat', or 'sigcmm-2.4.dll'. This indicates the use of specific tools and techniques employed by the Winnti threat group, as emulated by RedMimicry.