Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)
Flags rundll32.exe/cmd.exe launches with Winnti-specific DLL and temp batch indicators.
- Product
- windows
- Category
- process_creation
- Author
- Alexander Rausch (SigmaHQ), DRL 1.1
- Published
- 2020-06-24
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Defense EvasionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process creation events where a Windows command-line sequence invokes rundll32.exe or cmd.exe in combination with specific DLL and temporary batch artifacts. Such patterns matter because automated breach emulation and related tooling often relies on staging DLLs and executing a temporary batch file to carry out follow-on actions. The detection relies on Windows process creation telemetry, matching executable path endings and substring presence in the command line.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows process execution matching Winnti RedMimicry playbook (rundll32/cmd with temp batch and gthread/sigcmm DLLs)
id: c2519257-5f0a-48cd-88b6-13a9e35e243d
status: test
description: This rule flags process creation events where a Windows command-line sequence invokes rundll32.exe or cmd.exe in combination with specific DLL and temporary batch artifacts. Such patterns matter because automated breach emulation and related tooling often relies on staging DLLs and executing a temporary batch file to carry out follow-on actions. The detection relies on Windows process creation telemetry, matching executable path endings and substring presence in the command line.
references:
- https://redmimicry.com/posts/redmimicry-winnti/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_redmimicry_winnti_playbook.yml
author: Alexander Rausch, Huntrule Team
date: 2020-06-24
modified: 2023-03-01
tags:
- attack.execution
- attack.stealth
- attack.t1106
- attack.t1059.003
- attack.t1218.011
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith:
- \rundll32.exe
- \cmd.exe
CommandLine|contains:
- gthread-3.6.dll
- \Windows\Temp\tmp.bat
- sigcmm-2.4.dll
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 95022b85-ff2a-49fa-939a-d7b8f56eeb9b
type: derived