HackTool - RedMimicry Winnti Playbook Execution

Title: HackTool - RedMimicry Winnti Playbook Execution
Status: test
Description:Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility
References:
  -https://redmimicry.com/posts/redmimicry-winnti/
Author: Alexander Rausch
Date: 2020-06-24
modified:2023-03-01
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1106'
• -'attack.t1059.003'
• -'attack.t1218.011'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection:
    Image|endswith:
      -'\rundll32.exe'
      -'\cmd.exe'

    CommandLine|contains:
      -'gthread-3.6.dll'
      -'\Windows\Temp\tmp.bat'
      -'sigcmm-2.4.dll'

  condition:selection
Falsepositives:
  -Unknown
Level: high