Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1027Obfuscated Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Windows file creation events where filenames end with specific Winnti dropper artifacts: gthread-3.6.dll, sigcmm-2.4.dll, or a temporary batch file path ending with \Windows\Temp\tmp.bat. Such targeted drops are indicative of malware staging or execution preparation on a host. The detection relies on file event telemetry that includes the created or written file path and supports suffix matching on the target filename.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

Suspicious Base64 Decoded Payload Piped to Shell

Suspicious Shell Command Obfuscation via printf Escape Encoding on VMware ESXi (via process_creation)

Malicious Emmenhtal JavaScript Loader Spawning Encoded PowerShell

Suspicious Python Interpreter Launching Encoded PowerShell via subprocess

Suspicious PowerShell Download Of Text-Disguised Payload

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious PS1Bot PowerShell Payload Written to ProgramData (via file_event)

Malicious Non-Interactive Encoded PowerShell Stager (via process_creation)

Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)

Pivot detection · T1027 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-file-drops-matching-winnti-like-dll-and-batch-filenames-130c9e58

title: Windows File Drops Matching Winnti Dropper Artifacts (gthread/sigcmm DLLs, tmp.bat)
id: 2bf684ae-c97c-495a-afd7-0e458e3d5b84
status: test
description: "This rule flags Windows file creation events where filenames end with specific Winnti dropper artifacts: gthread-3.6.dll, sigcmm-2.4.dll, or a temporary batch file path ending with \\Windows\\Temp\\tmp.bat. Such targeted drops are indicative of malware staging or execution preparation on a host. The detection relies on file event telemetry that includes the created or written file path and supports suffix matching on the target filename."
references:
  - https://redmimicry.com/posts/redmimicry-winnti/#dropper
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_redmimicry_winnti_filedrop.yml
author: Alexander Rausch, Huntrule Team
date: 2020-06-24
modified: 2023-01-05
tags:
  - attack.stealth
  - attack.t1027
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \gthread-3.6.dll
      - \sigcmm-2.4.dll
      - \Windows\Temp\tmp.bat
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 130c9e58-28ac-4f83-8574-0a4cc913b97e
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL