huntrule

Windows Registry Event Triggered by RedMimicry Winnti Playbook (HTMLHelp\data)

Alerts on Windows registry events targeting HKLM\SOFTWARE\Microsoft\HTMLHelp\data associated with the RedMimicry Winnti playbook.

FreeUnreviewedSigmahighv1
title: Windows Registry Event Triggered by RedMimicry Winnti Playbook (HTMLHelp\data)
id: 55c1b903-bee4-4ea2-bf6a-1072cf015f41
status: test
description: This rule flags Windows registry events where the target object path contains HKLM\SOFTWARE\Microsoft\HTMLHelp\data, indicating manipulation under the HTML Help data location. Attackers may use such persistence or defense-impairment related registry changes to influence system behavior. The detection relies on Windows registry event telemetry capturing the TargetObject value associated with the action.
references:
  - https://redmimicry.com
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml
author: Alexander Rausch, Huntrule Team
date: 2020-06-24
modified: 2021-11-27
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1112
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains: HKLM\SOFTWARE\Microsoft\HTMLHelp\data
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 5b175490-b652-4b02-b1de-5b5b4083c5f8
    type: derived

What it detects

This rule flags Windows registry events where the target object path contains HKLM\SOFTWARE\Microsoft\HTMLHelp\data, indicating manipulation under the HTML Help data location. Attackers may use such persistence or defense-impairment related registry changes to influence system behavior. The detection relies on Windows registry event telemetry capturing the TargetObject value associated with the action.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.