Windows Process Creation Rule for Winnti-Related HK University Campaign Dropped Binaries

title: Windows Process Creation Rule for Winnti-Related HK University Campaign Dropped Binaries
id: 7c35d124-7dff-40ee-9744-0fb733403c4d
status: test
description: This rule flags Windows process creation events that match specific parent/child executable path and filename patterns associated with a Winnti malware campaign targeting Hong Kong universities. The behavior matters because it looks for telltale execution chains and dropped components (e.g., binaries under ProgramData\DRM with particular parent and child names). It relies on process creation telemetry that includes the creating process parent image path and the spawned process image path, as matched by the configured string and path conditions.
references:
  - https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Winnti/proc_creation_win_apt_winnti_mal_hk_jan20.yml
author: Florian Roth (Nextron Systems), Markus Neis, Huntrule Team
date: 2020-02-01
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - attack.g0044
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentImage|contains:
      - C:\Windows\Temp
      - \hpqhvind.exe
    Image|startswith: C:\ProgramData\DRM
  selection2:
    ParentImage|startswith: C:\ProgramData\DRM
    Image|endswith: \wmplayer.exe
  selection3:
    ParentImage|endswith: \Test.exe
    Image|endswith: \wmplayer.exe
  selection4:
    Image: C:\ProgramData\DRM\CLR\CLR.exe
  selection5:
    ParentImage|startswith: C:\ProgramData\DRM\Windows
    Image|endswith: \SearchFilterHost.exe
  condition: 1 of selection*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 3121461b-5aa0-4a41-b910-66d25524edbb
    type: derived