{"id":"5b175490-b652-4b02-b1de-5b5b4083c5f8","title":"RedMimicry Winnti Playbook Registry Manipulation","description":"Detects actions caused by the RedMimicry Winnti playbook","author":"Alexander Rausch","status":"test","level":"high","date":"2020-06-24","modified":"2021-11-27","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"product":"windows","category":"registry_event"},"falsepositives":["Unknown"],"references":["https://redmimicry.com"],"source_path":"rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml","source_sha256":"802c4b23ba589e5bdcf37491e2bd9335e19fc3d057cb27a19c47e354596490cd","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_redmimicry_winnti_reg.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: RedMimicry Winnti Playbook Registry Manipulation\nid: 5b175490-b652-4b02-b1de-5b5b4083c5f8\nstatus: test\ndescription: Detects actions caused by the RedMimicry Winnti playbook\nreferences:\n    - https://redmimicry.com\nauthor: Alexander Rausch\ndate: 2020-06-24\nmodified: 2021-11-27\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        TargetObject|contains: HKLM\\SOFTWARE\\Microsoft\\HTMLHelp\\data\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/5b175490-b652-4b02-b1de-5b5b4083c5f8.json","kind":"sigma"}