huntrule

Windows file drops matching Winnti-like DLL and batch filenames

Detects Windows file drops of specific DLLs and a Windows Temp batch filename pattern associated with a Winnti dropper scenario.

FreeUnreviewedSigmahighv1
title: Windows file drops matching Winnti-like DLL and batch filenames
id: 2bf684ae-c97c-495a-afd7-0e458e3d5b84
status: test
description: This rule flags Windows file system events where a dropped payload matches specific DLL and batch script filename patterns, including two DLL names and a temporary batch file path. Such file drops can indicate stealthy staging or preparation of malware components prior to execution. The detection relies on Windows file event telemetry that includes the target filename for each write/drop operation.
references:
  - https://redmimicry.com/posts/redmimicry-winnti/#dropper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml
author: Alexander Rausch, Huntrule Team
date: 2020-06-24
modified: 2023-01-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \gthread-3.6.dll
      - \sigcmm-2.4.dll
      - \Windows\Temp\tmp.bat
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 130c9e58-28ac-4f83-8574-0a4cc913b97e
    type: derived

What it detects

This rule flags Windows file system events where a dropped payload matches specific DLL and batch script filename patterns, including two DLL names and a temporary batch file path. Such file drops can indicate stealthy staging or preparation of malware components prior to execution. The detection relies on Windows file event telemetry that includes the target filename for each write/drop operation.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.