title: Winnti Pipemon Characteristics
id: 73d70463-75c9-4258-92c6-17500fe972f2
status: stable
description: Detects specific process characteristics of Winnti Pipemon malware reported by ESET
author: Florian Roth, oscd.community
references:
  - https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/
date: 2020/07/30
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    CommandLine|contains: 'setup0.exe -p'
  selection2a:
    CommandLine|contains: 'setup.exe'
  selection2b:
    CommandLine|endswith:
      - '-x:0'
      - '-x:1'
      - '-x:2'
  condition: selection1 or all of selection2*
falsepositives:
  - Legitimate setups that use similar flags
level: critical
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.g0044
