Potential Winnti malware dropper activity
Detection logic for files associated with Winnti group activity, specifically identified in the RedMimicry analysis of Winnti dropper behavior.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 02:46 UTC
- Detection
- 1 rule
- Source quality
- B2Roughly even chance
This brief identifies specific file artifacts documented in the RedMimicry Winnti playbook that are indicative of dropper activity. The activity relates to the deployment of DLLs and batch files in specific directory paths commonly associated with the Winnti group.
Recommendation
- Deploy the provided Sigma rule to your SIEM to monitor for the creation of identified dropper artifacts.
- Review historical file creation events in Windows Temp directories and other suspicious locations for the listed filenames.
- Investigate the source process associated with any file creation event matching these filenames to determine the initial infection vector.
Immediate actions
Deploy Sigma rule to monitor for identified file artifacts
Threat Hunt
Search for historical file creation of gthread-3.6.dll, sigcmm-2.4.dll, or tmp.bat
Data: File creation logs
Detection coverage 1
Potential Winnti Dropper Activity
highDetects the creation of files historically associated with Winnti group dropper activity.
Detection queries are available on the platform. Get full rules →