Windows Process Creation: Winnti Pipemon setup.exe Command-Line Flags

Alerts on Windows processes launching Pipemon-style setup.exe command lines with specific -p or -x:n flags.

FreeUnreviewedSigmacriticalv1

windows-process-creation-winnti-pipemon-setup-exe-command-line-flags-73d70463

title: "Windows Process Creation: Winnti Pipemon setup.exe Command-Line Flags"
id: ded7cb1c-110f-4461-bf2f-a5466454d895
status: stable
description: This rule flags Windows process creation events where the command line matches specific Pipemon setup executable characteristics, including 'setup0.exe -p' and 'setup.exe' with one of several '-x:n' argument endings. Such patterned installer-like command lines can indicate malware dropper behavior and execution staging. The detection relies on process creation telemetry, specifically the CommandLine field, to match the listed substrings and suffixes.
references:
  - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/TA/Winnti/proc_creation_win_apt_winnti_pipemon.yml
author: Florian Roth (Nextron Systems), oscd.community, Huntrule Team
date: 2020-07-30
modified: 2021-11-27
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
  - attack.g0044
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_1:
    CommandLine|contains: setup0.exe -p
  selection_2:
    CommandLine|contains: setup.exe
    CommandLine|endswith:
      - -x:0
      - -x:1
      - -x:2
  condition: 1 of selection_*
falsepositives:
  - Legitimate setups that use similar flags
level: critical
license: DRL-1.1
related:
  - id: 73d70463-75c9-4258-92c6-17500fe972f2
    type: derived

What it detects

This rule flags Windows process creation events where the command line matches specific Pipemon setup executable characteristics, including 'setup0.exe -p' and 'setup.exe' with one of several '-x:n' argument endings. Such patterned installer-like command lines can indicate malware dropper behavior and execution staging. The detection relies on process creation telemetry, specifically the CommandLine field, to match the listed substrings and suffixes.

Known false positives

Legitimate setups that use similar flags

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.