Windows Process Creation: rundll32/cmd.exe Indicators of RedMimicry Winnti HackTool Execution

title: "Windows Process Creation: rundll32/cmd.exe Indicators of RedMimicry Winnti HackTool Execution"
id: c2519257-5f0a-48cd-88b6-13a9e35e243d
status: test
description: This rule identifies Windows process creation events where rundll32.exe or cmd.exe is launched with command-line indicators consistent with executing specific DLL names and a batch file in a temporary path. Such activity can reflect attacker tooling or post-compromise execution patterns that rely on running embedded components and transient scripts. The detection relies on process creation telemetry including the process image path and full command line.
references:
  - https://redmimicry.com/posts/redmimicry-winnti/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml
author: Alexander Rausch, Huntrule Team
date: 2020-06-24
modified: 2023-03-01
tags:
  - attack.execution
  - attack.stealth
  - attack.t1106
  - attack.t1059.003
  - attack.t1218.011
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    Image|endswith:
      - \rundll32.exe
      - \cmd.exe
    CommandLine|contains:
      - gthread-3.6.dll
      - \Windows\Temp\tmp.bat
      - sigcmm-2.4.dll
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
    type: derived