Winnti Pipemon Characteristics

stablecritical
log source: windows · process_creationauthor Florian Roth (Nextron Systems), oscd.communitydate 2020-07-30
01

description

What this is, in brief.

Detects specific process characteristics of Winnti Pipemon malware reported by ESET

02

tags

attack.privilege-escalationattack.persistenceattack.executionattack.stealthattack.t1574.001attack.g0044detection.emerging-threats
03

rule source (YAML)

title: Winnti Pipemon Characteristics
id: 73d70463-75c9-4258-92c6-17500fe972f2
status: stable
description: Detects specific process characteristics of Winnti Pipemon malware reported by ESET
references:
    - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
author: Florian Roth (Nextron Systems), oscd.community
date: 2020-07-30
modified: 2021-11-27
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
    - attack.g0044
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_1:
        CommandLine|contains: 'setup0.exe -p'
    selection_2:
        CommandLine|contains: 'setup.exe'
        CommandLine|endswith:
            - '-x:0'
            - '-x:1'
            - '-x:2'
    condition: 1 of selection_*
falsepositives:
    - Legitimate setups that use similar flags
level: critical
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

groups named (1)

Threat groups associated with this.

06

references

External citations — patches, advisories, analysis.