huntrule

Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)

Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Alexander Rausch (SigmaHQ), DRL 1.1
Published
2020-06-24
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation events where a Windows command-line sequence invokes rundll32.exe or cmd.exe in combination with specific DLL and temporary batch artifacts. Such patterns matter because automated breach emulation and related tooling often relies on staging DLLs and executing a temporary batch file to carry out follow-on actions. The detection relies on Windows process creation telemetry, matching executable path endings and substring presence in the command line.

Reporting behind it

Related detections9 linkedT1218.011 — drag to rearrange
Windows Process Creation: Suspicious Children Spawned by HTML Help (hh.exe)
Windows: Alert on Suspicious HH.EXE Process Execution
Windows rundll32 Trojan Loader Execution via Local AppData and .dat Parameters
Windows rundll32 execution matching ZxShell function and remote disk strings
Malicious Shell Spawned by SharePoint Worker Process w3wp
Andromeda Loader Execution via Rundll32 Desktop.ini Ordinal
Suspicious rundll32 Execution of sqlite3 DLL by Ordinal with TLB Argument
Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)
Suspicious IP Release and Renew via Minimized cmd During Driver Install
Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)
Pivot detection · T1218.011 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.