Windows process activity matching Winnti malware traits from ProgramData\DRM paths
Detects suspicious Winnti-like execution where ProgramData\DRM processes spawn specific child binaries with known parent path patterns.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Markus Neis (SigmaHQ), DRL 1.1
- Published
- 2020-02-01
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events that match a set of specific parent/child process path patterns tied to Winnti malware behavior. Attackers can use these staged executable names and locations under ProgramData\DRM to persist, execute, and blend in with legitimate system activity. The detection relies on process creation telemetry, including ParentImage and Image full paths, to match the exact path-based characteristics.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process activity matching Winnti malware traits from ProgramData\DRM paths
id: 7c35d124-7dff-40ee-9744-0fb733403c4d
status: test
description: This rule identifies Windows process creation events that match a set of specific parent/child process path patterns tied to Winnti malware behavior. Attackers can use these staged executable names and locations under ProgramData\DRM to persist, execute, and blend in with legitimate system activity. The detection relies on process creation telemetry, including ParentImage and Image full paths, to match the exact path-based characteristics.
references:
- https://www.welivesecurity.com/2020/01/31/winnti-group-targeting-universities-hong-kong/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Winnti/proc_creation_win_apt_winnti_mal_hk_jan20.yml
author: Florian Roth (Nextron Systems), Markus Neis, Huntrule Team
date: 2020-02-01
modified: 2021-11-27
tags:
- attack.privilege-escalation
- attack.persistence
- attack.execution
- attack.stealth
- attack.t1574.001
- attack.g0044
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection1:
ParentImage|contains:
- C:\Windows\Temp
- \hpqhvind.exe
Image|startswith: C:\ProgramData\DRM
selection2:
ParentImage|startswith: C:\ProgramData\DRM
Image|endswith: \wmplayer.exe
selection3:
ParentImage|endswith: \Test.exe
Image|endswith: \wmplayer.exe
selection4:
Image: C:\ProgramData\DRM\CLR\CLR.exe
selection5:
ParentImage|startswith: C:\ProgramData\DRM\Windows
Image|endswith: \SearchFilterHost.exe
condition: 1 of selection*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 3121461b-5aa0-4a41-b910-66d25524edbb
type: derived