RedMimicry Winnti Playbook Registry Manipulation

Title: RedMimicry Winnti Playbook Registry Manipulation
Status: test
Description:Detects actions caused by the RedMimicry Winnti playbook
References:
  -https://redmimicry.com
Author: Alexander Rausch
Date: 2020-06-24
modified:2021-11-27
Tags:

• -'attack.persistence'
• -'attack.defense-impairment'
• -'attack.t1112'

Logsource:

• product: windows
• category: registry_event

Detection:
  selection:
    TargetObject|contains: 'HKLM\SOFTWARE\Microsoft\HTMLHelp\data'
  condition:selection
Falsepositives:
  -Unknown
Level: high