NeedyMantis / Storm-3069 Post-Compromise Backdoor

Modular Windows backdoor deployed after network access is already established: DLL sideloading via signed tools (Poedit, curl, Vim, TightVNC) loads an encrypted custom archive, runs a shellcode-in-a-.ps1 second-stage loader, and beacons HTTPS-to-WebSocket C2 with RC4 encryption and operator-loadable modules.

Threat

NeedyMantis / Storm-3069

Severity

HIGH

Type

Post-Compromise Modular Backdoor, Suspected China-Nexus Actor

Access

Post-compromise deployment (T1021.002, T1570); not an initial-access vector

Version

v0.1 (Draft)

Author

HuntPack

Confidence

High (single first-party primary source; syndicated coverage only)

Generated

2026-09-29

Executive Summary

Microsoft Threat Intelligence disclosed NeedyMantis on 2026-09-28: a modular, post-compromise Windows malware family used to maintain long-term access after a network is already breached. Microsoft found it while pivoting from indicators tied to Kaspersky's DAEMON Tools supply-chain investigation, though Microsoft has not observed NeedyMantis itself being distributed through a supply-chain compromise; it is deployed only after an actor already has a foothold. Activity traces back to at least October 2025 and has hit a small, selectively chosen set of victims: telecommunications firms, universities, medical nonprofits, intergovernmental organizations, and government contractors. Microsoft attributes observed use to threat actors operating from China and has designated the primary operator Storm-3069, without attributing it to a specific nation-state; it has not ruled out that more than one operator has access to the malware. Other public reporting has linked related activity to Google Threat Intelligence's UNC6863 cluster.

NeedyMantis ships as a three-part bundle: a legitimate signed program (Poedit, curl, Vim, and TightVNC are documented; Microsoft has also observed masquerades of Microsoft Office, Broadcom, Intel, and NVIDIA components), a malicious DLL with a legitimate-sounding name that the program sideloads on launch, and a custom encrypted file archive. The sideloaded DLL extracts a second-stage loader (in the analyzed sample, a file literally named encryptbase64.ps1 that, despite its extension, contains x64 shellcode rather than a PowerShell script) which decodes and loads the main component. That component creates a mutex named <username>-<processname>, then beacons over HTTPS before upgrading the connection to a WebSocket carrying an RC4-encrypted binary protocol to corp.tripswithengine.com on port 443 (URI /library/zip/), using a hard-coded firefox/21.0 user agent. From there it can load and unload additional operator-supplied modules; the capabilities of those modules remain unconfirmed by Microsoft.

In one observed incident, an operator used the Impacket toolkit for hands-on-keyboard activity: copying the legitimate program, malicious DLL, and archive from a network share and executing them on a target host. This illustrates one path by which NeedyMantis reaches a device once an actor already has access, not the initial-access method itself. An older variant Microsoft analyzed (October 2025, built around a libcurl-named archive) carried a persistence module named is that installs a Windows service instead of relying purely on the loader chain. Microsoft Defender flags the malware as TrojanDropper:Win64/NeedyMantis and Behavior:Win64/NeedyMantis, and flags the observed Impacket activity separately as HackTool:Win32/Impacket.

Defender priority: every atomic indicator in this pack traces to a single primary source, the Microsoft Security blog post (2026-09-28). The Hacker News and CyberKendra coverage saved alongside it are syndicated summaries of that same Microsoft report, not independent research, so this pack does not count them as a second independent source. Per this pack's evidentiary bar, §10's Falcon IOC CSV ships at action=detect only; nothing here is promoted to a blocking or prevent posture. Lean on the behavioral queries in §8, which target the documented DLL sideload mechanics rather than infrastructure alone.

Source Review & Web Hunter Notes

#	Tier	Source	Date	Key Finding	Carry Forward
1	T1	Microsoft Security Blog: "NeedyMantis: Unpacking a post-compromise malware family used in targeted operations"	2026-09-28	Primary technical analysis: full architecture (loader, archive format, second-stage loader, main component), all 3 file hashes, all 9 documented DLL sideload paths, C2 configuration/protocol detail, Defender detection names, mitigation guidance, and Microsoft's own KQL hunting queries	Yes. Primary source for every atomic IOC and technical claim in this pack.
2	T2	The Hacker News: "Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks"	2026-09-29	Syndicated summary of the Microsoft report, restates the same hashes, C2 domain, DLL paths, and detection names with no new atomic indicators	Partial. Confirms wider media pickup and framing; not treated as an independent second source since it cites Microsoft as its origin.
3	T3	Cyber Kendra: "Microsoft Details NeedyMantis Post-Compromise Malware"	2026-09-29	Syndicated summary of the Microsoft report; adds a paraphrase of the C2 URI path and DAEMON Tools version-range remediation note, no new atomic indicators	Partial. Same caveat as row 2, aggregator digest of the same primary source.

Tier definitions: T1 vendor/primary-discoverer research; T2 reputable security press; T3 aggregator or digest site.

Prompt-injection check: none of the three fetched pages contained instructions directed at the research agent. No embedded directives to run commands, fetch an alternate "real" IOC source, or alter these instructions were found in any snapshot. All fetched content was treated as data, not instructions.

Hunt Brief & Attack Chain

Hunt hypotheses (ordered by fidelity)

#	Hypothesis	MITRE	Falcon Telemetry	Expected FP	Confidence
H1	A legitimate signed tool (Poedit, curl, Vim, TightVNC) loads a same-named malicious DLL from one of the nine documented staging paths instead of its real install location	T1574.002, T1036.005	ProcessRollup2, PeFileWritten	Low. These exact folder/filename combinations have no legitimate use.	High
H2	One of six spoofed system-DLL basenames (WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, nvml.dll) is written somewhere under %ProgramData% outside the nine documented combos, indicating a masquerade-folder variant Microsoft has not yet published	T1574.002, T1036.005	PeFileWritten	Medium. dbghelp.dll and jli.dll ship legitimately with several vendor installers.	Medium
H3	The sample-specific second-stage loader artifact (`encryptbase64.ps1`) appears on a process command line or file reference	T1027, T1140	ProcessRollup2, SyntheticProcessRollup2	Low, but this filename is confirmed for only one analyzed sample and may rotate.	Medium
H4	A sideload-abused binary executes from a documented staging path and, within the same process lifetime, opens an outbound network connection	T1574.002, T1071.001	ProcessRollup2 joined with NetworkConnectIP4	Medium. Legitimate vendor tooling can sit in similarly named ProgramData folders.	High
H5	A host resolves or connects to the NeedyMantis C2 domain `corp.tripswithengine.com`	T1071.001	DnsRequest, NetworkConnectIP4	Low, but this infrastructure is perishable	High while current
H6	A Windows service is installed with an ImagePath inside one of the nine documented staging folders, echoing the Windows-service persistence module Microsoft observed in an older NeedyMantis variant	T1543.003	CreateService	Low	Medium. The older variant's own drop location is not documented; this reuses the newer sample's known folders as a proxy.
H7	Hands-on-keyboard Impacket activity spawns `cmd.exe` with a `services.exe` parent and the `/Q /c` argument pattern characteristic of wmiexec-style remote execution	T1047, T1569.002	ProcessRollup2, SyntheticProcessRollup2	Medium. Some RMM/management agents launch cmd.exe via services.exe too.	High
H8	A process command line references a UNC network-share path together with one of the six spoofed DLL basenames, matching Microsoft's description of an operator copying the bundle from a network share via Impacket	T1570, T1021.002	ProcessRollup2, SyntheticProcessRollup2	Low. This exact combination has no legitimate business use.	High

Attack chain

Step	Action	Telemetry	Hunt Angle
1	Actor already has network access. The initial-access method varies per intrusion; NeedyMantis itself is not the initial-access vector and Microsoft has not observed it distributed via supply chain	Out of scope for this pack; see your own IR findings for the intrusion's origin	N/A. Pre-condition, not a NeedyMantis behavior.
2	Operator stages the three-part bundle (legitimate binary, malicious DLL, encrypted archive), in one observed case copying it from a network share via the Impacket toolkit	ProcessRollup2 (Impacket process patterns), PeFileWritten	Q10, Q11
3	The legitimate program launches and sideloads the malicious first-stage DLL from one of the nine documented paths	ProcessRollup2, PeFileWritten	Q1, Q2, Q3
4	The first-stage loader (obfuscated stack strings, two anti-debug checks) extracts the second-stage loader (`encryptbase64.ps1` in the analyzed sample) from the archive and runs it in-process	Not independently visible. In-process extraction and execution.	GAP (see §15); Q5 catches the sample-specific filename if it surfaces on a command line
5	The second-stage loader (x64 shellcode despite its .ps1 name) decodes and decompresses the embedded main component, a minimized custom-format PE	In-memory only	GAP
6	The main component creates a mutex (`<username>-<processname>`) and, via a `ws2_32.dll`-named communications module, beacons an HTTPS GET whose `Set-Cookie` header carries Base64-encoded, compressed host recon (computer name, username, process list, ProgramFiles contents, parent process) to `corp.tripswithengine.com:443/library/zip/`	DnsRequest, NetworkConnectIP4 (no Falcon field for Set-Cookie contents)	Q7, Q8; the recon-in-cookie step itself is a GAP
7	The connection upgrades to WebSocket and negotiates an RC4 key, then continues a 44-byte-header binary protocol (compressed, optionally RC4-encrypted) for command and control	NetworkConnectIP4 (protocol internals are not visible to Falcon)	Q8; protocol internals are a GAP
8	Operator issues load-module (1020), unload-module (1030), or dispatch-data (1050/1150) commands to extend functionality; module capabilities are unconfirmed by Microsoft	None distinct from the C2 channel itself	GAP (capability-level, see §15)
9	Older variant only (October 2025 sample): a persistence module named `is` registers NeedyMantis as a Windows service instead of relying on the loader chain alone	CreateService	Q9 (path-based proxy detection; exact service name/path not documented for this variant)

Consolidated IOC Table

Every atomic row below is sourced to exactly one public reporter, the Microsoft Security blog (2026-09-28). Per this pack's prevent-posture rule, Action = detect/hunt/enrich only for every indicator; none are promoted to a blocking posture.

Type	Value	Confidence	Action	Context	Expiry
sha256	e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e	High	detect	`WinSparkle.dll`: first-stage sideload loader (Poedit masquerade), observed 2026-05-21	2027-03-29
sha256	9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef	High	detect	`WinSparkle` custom encrypted file archive (11 embedded files), observed 2026-05-23	2027-03-29
sha256	c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77	High	detect	`libcurl` custom encrypted file archive. Older variant (October 2025); contains the Windows-service persistence module `is`	2027-03-29
domain	corp.tripswithengine.com	High	detect	C2 host. HTTPS initial beacon upgrading to WebSocket, port 443, URI `/library/zip/`	2027-03-29
port	443/tcp	N/A	enrich	Standard HTTPS port, deliberately reused for C2 to blend with normal egress. Not distinguishing on its own; pair with the domain (Q7/Q8).	(technique-level)
useragent	firefox/21.0	Medium	enrich	Hard-coded WinINet user agent on the communications DLL. Useful as a proxy/SWG pivot (§7); Falcon's process/network events carry no HTTP-header field for it.	(technique-level)
path-pattern	%ProgramFiles%\Poedit\WinSparkle.dll	High	detect	Documented sideload combo 1 of 9	(technique-level)
path-pattern	%ProgramData%\USOShared\libcurl.dll	High	detect	Documented sideload combo 2 of 9	(technique-level)
path-pattern	%ProgramData%\VIM\vim64.dll	High	detect	Documented sideload combo 3 of 9	(technique-level)
path-pattern	%ProgramData%\TightVNC\VIM\vim64.dll	High	detect	Documented sideload combo 4 of 9	(technique-level)
path-pattern	%ProgramData%\office\dbghelp.dll	High	detect	Documented sideload combo 5 of 9 (Microsoft Office masquerade)	(technique-level)
path-pattern	%ProgramData%\broadcom\dbghelp.dll	High	detect	Documented sideload combo 6 of 9 (Broadcom masquerade)	(technique-level)
path-pattern	%ProgramData%\Intel\jli.dll	High	detect	Documented sideload combo 7 of 9 (Intel masquerade)	(technique-level)
path-pattern	%ProgramFiles%\modifiable\nvml.dll	High	detect	Documented sideload combo 8 of 9 (NVIDIA masquerade)	(technique-level)
path-pattern	%ProgramData%\ics\nvml.dll	High	detect	Documented sideload combo 9 of 9 (NVIDIA masquerade)	(technique-level)
filename	encryptbase64.ps1	Medium	hunt	Second-stage loader filename in the analyzed sample. Contains x64 shellcode, not a real PowerShell script; per-sample and may rotate.	2027-01-29
detection-name	TrojanDropper:Win64/NeedyMantis	N/A	enrich	Microsoft Defender static/dropper detection	(technique-level)
detection-name	Behavior:Win64/NeedyMantis	N/A	enrich	Microsoft Defender behavioral (C2-connectivity) detection	(technique-level)
detection-name	HackTool:Win32/Impacket	N/A	enrich	Microsoft Defender detection for observed post-compromise Impacket activity accompanying NeedyMantis deployment	(technique-level)

Affected Surface & Telemetry Matrix

Surface	Required Telemetry	Priority	Gap Risk
Windows endpoints running Poedit, curl, Vim, or TightVNC, or where Office/Broadcom/Intel/NVIDIA DLL components could be masqueraded	ProcessRollup2, SyntheticProcessRollup2, PeFileWritten	Critical	Low. Standard Falcon sensor telemetry.
Windows Services subsystem (older-variant persistence)	CreateService	Medium	Low sensor risk, but the exact older-variant service name/path is undocumented, so detection here is a proxy, not a literal match.
Network egress / DNS	DnsRequest, NetworkConnectIP4	High	Medium. Infrastructure is perishable and DNS-based detection depends on the domain staying live.
Web / SWG proxy layer (User-Agent, URI path)	Not a Falcon telemetry source. Proxy/SWG logs only	Medium	Gap. Covered only by §7 native hunt guidance, not CQL.
In-process loader/shellcode execution (stack-string deobfuscation, anti-debug checks, archive decode, mutex creation, Set-Cookie recon exfil)	None. No Falcon event captures in-process behavior or named-object creation	Medium	Gap. Rely on the artifacts the loader leaves behind instead (file writes, path anomalies, network egress; §8, §15).
Lateral deployment tooling (Impacket)	ProcessRollup2 (parent/child and command-line patterns)	High	Medium. Impacket's own modules vary technique to technique; this pack covers the two documented patterns (wmiexec-style execution and network-share bundle copy).

ATT&CK Mapping

Tactic	Technique	Name	Observed Behavior	Query / Control
Defense Evasion / Persistence	T1574.002	Hijack Execution Flow: DLL Side-Loading	A legitimate signed binary loads a same-named malicious DLL from one of nine documented staging paths	Q1, Q2, Q3
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name or Location	Malicious DLL and its host binary both live under a ProgramData/ProgramFiles subfolder mimicking a real vendor install	Q2, Q3, Q4
Defense Evasion	T1027	Obfuscated Files or Information	Stack-string obfuscation in both loader stages; XOR-encoded custom archive format; RC4-encrypted C2 payload data	GAP: in-memory only
Defense Evasion	T1140	Deobfuscate/Decode Files or Information	`RtlDecompressBuffer` decompression and XOR decode of the archive and second-stage payload	GAP
Defense Evasion	T1622	Debugger Evasion	`ProcessDebugFlags` and `ThreadHideFromDebugger` anti-debug checks in the first-stage loader	GAP
Defense Evasion / Execution	T1055	Process Injection (in-process shellcode execution)	`encryptbase64.ps1` contains x64 shellcode executed in-process by the first-stage loader, not by a script interpreter	GAP; Q5 catches only the sample-specific filename if it surfaces on a command line
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	Initial HTTPS beacon escalating to a WebSocket connection, deliberately on standard port 443	Q7, Q8
Command and Control	T1573.001	Encrypted Channel: Symmetric Cryptography	RC4-encrypted binary C2 protocol after a key-exchange handshake	GAP for the crypto itself; Q8 catches the resulting connection
Command and Control	T1132.001	Data Encoding: Standard Encoding	Base64-encoded, compressed host recon smuggled in the initial HTTPS `Set-Cookie` header	GAP: no Falcon field for cookie contents
Discovery	T1082	System Information Discovery	Computer name, username, and ProgramFiles directory contents exfiltrated in the initial beacon cookie	GAP
Discovery	T1057	Process Discovery	Running process list included in the initial beacon cookie	GAP
Command and Control	T1129	Shared Modules	Main component loads and unloads operator-supplied modules over the C2 channel (commands 1020/1030)	GAP: capability-level, no distinct artifact beyond the channel itself
Persistence	T1543.003	Create or Modify System Process: Windows Service	Older (October 2025) variant persistence module `is` registers via a Windows service	Q9 (proxy detection; exact path undocumented)
Lateral Movement	T1021.002	Remote Services: SMB/Windows Admin Shares	Operator copies the legitimate binary, malicious DLL, and archive from a network share for execution	Q11
Lateral Movement	T1570	Lateral Tool Transfer	The full three-part bundle is transferred to the target host as a unit ahead of execution	Q11
Execution	T1047	Windows Management Instrumentation	`cmd.exe` spawned with a `services.exe` parent and `/Q /c` arguments, characteristic of wmiexec-style Impacket execution	Q10
Execution	T1569.002	System Services: Service Execution	Impacket-style remote service creation and execution used to run the bundle	Q10, Q11 give partial coverage; the exact service-creation artifact is not independently confirmed in the source reporting

Native Audit-Log Hunts

Checks that do not depend on Falcon CQL. Use where Sysmon, Windows auditing, a proxy/SWG, or Microsoft Defender is the only telemetry available, or to cross-validate a Falcon hit.

Sysmon

Event ID 7 (Image Loaded): ImageLoaded ends in one of WinSparkle.dll, libcurl.dll, vim64.dll, dbghelp.dll, jli.dll, nvml.dll, AND the loading path matches one of the nine documented combos, or more broadly any ProgramData/ProgramFiles subfolder outside System32/SysWOW64. This is the only telemetry, native or Falcon, that observes the actual DLL load event itself rather than the file write that preceded it.
Event ID 1 (Process Create): CommandLine contains encryptbase64; or Image path matches one of the nine documented folders; or ParentImage ends in services.exe and CommandLine matches the cmd.exe /Q /c pattern.
Event ID 3 (Network Connect): DestinationHostname = corp.tripswithengine.com, or the IP that name currently resolves to.
Event ID 22 (DNS Query): QueryName = corp.tripswithengine.com.
Event ID 13 (Registry) or Event ID 6 (Driver Loaded): not expected to fire for this threat; NeedyMantis's persistence is service-based (older variant) or loader-chain-based, not registry ASEP.

Windows Security auditing

Event ID 4688 (process creation, with command-line auditing enabled via Include command line in process creation events GPO) as a fallback for the Sysmon process rules above on hosts without Sysmon.
Event ID 7045 (a new service was installed) and Event ID 4697 (a service was installed in the system) for the older-variant persistence module, cross-referenced against the nine documented folder names in the service's ImagePath.
Zone.Identifier alternate data stream on the legitimate installer package, if it arrived by download or email ahead of the operator staging NeedyMantis into it. This corroborates a delivery vector for the carrier software even though NeedyMantis itself is a post-compromise tool, not the initial-access payload.

Proxy / SWG

Alert on outbound HTTPS/WebSocket sessions carrying User-Agent firefox/21.0 together with a URI path of /library/zip/, especially from a server or infrastructure host that has no legitimate reason to present a browser-identifying user agent.
Alert on, or retroactively hunt for, connections to corp.tripswithengine.com in proxy and DNS logs.

Microsoft Defender / MDE portal (if licensed)

Search directly for the three Defender detection names: TrojanDropper:Win64/NeedyMantis, Behavior:Win64/NeedyMantis, HackTool:Win32/Impacket.
Run Microsoft's own published hunting queries from the primary source: a DeviceFileEvents/DeviceProcessEvents query for the nine documented DLL paths, and a search in (DeviceNetworkEvents, EmailUrlInfo, UrlClickEvents, DeviceEvents, DeviceFileEvents, DeviceProcessEvents) query for corp.tripswithengine.com.

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives "Open in Falcon"): Pick your tenant's cloud first. Every "Open in Falcon" button below uses this selection.

Q1 · Known NeedyMantis Atomic Hash Match

CONF HIGHFP LOWCOST LOW

Looks for: execution or on-disk writes of the three published NeedyMantis hashes (first-stage loader, current-sample archive, older-variant archive). FP: low. These are campaign-specific artifact hashes.

// HUNT: Known NeedyMantis Atomic Hash Match
// MITRE: T1574.002
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2, PeFileWritten
// FALSE POSITIVES: none expected. These are campaign-specific file hashes
// LOOKBACK: 90d (set via the Falcon time picker, not an in-query filter)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2|PeFileWritten/
| SHA256HashData=/^(e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e|9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef|c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77)$/i
| table([ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData, CommandLine])

Q2 · Spoofed DLL Written to a Documented NeedyMantis Sideload Path

CONF HIGHFP LOWCOST LOW

Looks for: a PE write whose target path matches one of the nine documented Microsoft-published DLL basename-plus-folder combinations. FP: low. None of these exact combinations has a legitimate reason to exist.

// HUNT: Spoofed DLL Written to a Documented NeedyMantis Sideload Path
// MITRE: T1574.002, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: PeFileWritten
// FALSE POSITIVES: none expected. These nine folder/filename combinations are documented malware staging paths, not real vendor install locations
#event_simpleName=PeFileWritten
| TargetFileName=/\\(Poedit\\WinSparkle|USOShared\\libcurl|(TightVNC\\)?VIM\\vim64|office\\dbghelp|broadcom\\dbghelp|Intel\\jli|modifiable\\nvml|ics\\nvml)\.dll$/i
| table([ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName])

Q3 · Process Executing From a Documented Sideload Staging Folder

CONF HIGHFP MEDIUMCOST LOW

Looks for: any process (the sideloaded host binary itself, not the DLL) executing from one of the nine documented staging folder names. FP: medium. Folder names like Intel and broadcom under ProgramData legitimately exist for real vendor driver/utility packages on many fleets.

// HUNT: Process Executing From a Documented NeedyMantis Sideload Staging Folder
// MITRE: T1574.002, T1036.005
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: legitimate Intel, Broadcom, and Office-adjacent vendor tooling can install into similarly named ProgramData subfolders
// TUNING: exclude known-good vendor executables in these folders by signer/hash once you confirm legitimate installs (e.g. real Intel driver-suite or Broadcom utility binaries) before promoting to an alert
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/\\(Poedit|USOShared|TightVNC\\VIM|VIM|office|broadcom|Intel|modifiable|ics)\\[^\\]+\.exe$/i
| table([ComputerName, UserName, ImageFileName, CommandLine, ParentBaseFileName])

Q4 · Spoofed System-DLL Basename Outside the Nine Documented Folders (Future-Variant Net)

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: the six spoofed system-DLL basenames written into any ProgramData subfolder, not just the nine documented combos. Catches a masquerade-folder variant Microsoft has not yet published. FP: medium to high. dbghelp.dll and jli.dll (a real Java Runtime file) legitimately ship with several vendor installers.

// HUNT: Spoofed System-DLL Basename Outside the Nine Documented Folders
// MITRE: T1574.002, T1036.005
// CONF: medium  FP: medium  COST: low
// REQUIRES: PeFileWritten
// FALSE POSITIVES: dbghelp.dll ships with many debugging/crash-reporter tools; jli.dll is a legitimate Java Runtime component bundled by Oracle/Adoptium/Eclipse Temurin installers
// TUNING: exclude known-good vendor install paths for Java runtimes (…\Java\, …\Eclipse Adoptium\), Visual Studio/Windows SDK debugging tools, and any code-signed writer process already confirmed benign in your environment
#event_simpleName=PeFileWritten
| TargetFileName=/\\ProgramData\\[^\\]+\\(WinSparkle|libcurl|vim64|dbghelp|jli|nvml)\.dll$/i
| table([ComputerName, UserName, TargetFileName, SHA256HashData, ContextBaseFileName])

Q5 · Sample-Specific Second-Stage Loader Reference (encryptbase64.ps1)

CONF MEDIUMFP LOWCOST LOW

Looks for: the literal second-stage loader filename from the analyzed sample appearing on a process command line. FP: low, but coverage is partial by design: the loader typically runs this file's content in-process as shellcode rather than spawning a new process against it, and the filename itself is documented to vary sample-to-sample (the older variant used entirely different names).

// HUNT: Sample-Specific Second-Stage Loader Reference (encryptbase64.ps1)
// MITRE: T1027, T1140
// CONF: medium  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: none expected for this literal filename, but this is a single-sample artifact; a negative result is inconclusive, not clean
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/encryptbase64/i
| table([ComputerName, UserName, FileName, CommandLine, ParentBaseFileName])

Q6 · Sideload-Staging Process Followed by Outbound Network Connection

CONF HIGHFP MEDIUMCOST MEDIUM

Looks for: a process executing from one of the nine documented staging folders that also makes an outbound network connection in the same process lifetime, narrowing Q3 to hosts where the loader actually reached the network. FP: medium. Same underlying path condition as Q3; the join narrows but does not eliminate legitimate vendor-tool false positives.

// HUNT: Sideload-Staging Process Followed by Outbound Network Connection
// MITRE: T1574.002, T1071.001
// CONF: high  FP: medium  COST: medium
// REQUIRES: ProcessRollup2, NetworkConnectIP4
// FALSE POSITIVES: same vendor-folder population as Q3; a legitimate tool in one of these folders that also happens to phone home will still surface here
// TUNING: exclude known-good vendor executables already cleared for Q3, and exclude expected internal telemetry/update endpoints for those tools
#event_simpleName=ProcessRollup2
| ImageFileName=/\\(Poedit|USOShared|TightVNC\\VIM|VIM|office|broadcom|Intel|modifiable|ics)\\[^\\]+\.exe$/i
| rename(field=TargetProcessId_decimal, as=ContextProcessId_decimal)
| join(query={#event_simpleName=NetworkConnectIP4}, field=ContextProcessId_decimal, mode=left)
| table([ComputerName, UserName, ImageFileName, CommandLine, RemoteAddressIP4, RemotePort])

Q7 · DNS Resolution to NeedyMantis C2 Domain

CONF HIGHFP LOWCOST LOW

Looks for: resolution of this campaign's C2 domain. FP: low, but this infrastructure is perishable; a miss is inconclusive, not clean.

// HUNT: DNS Resolution to NeedyMantis C2 Domain
// MITRE: T1071.001
// CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// FALSE POSITIVES: none expected. Single-purpose campaign infrastructure
#event_simpleName=DnsRequest
| DomainName=/^corp\.tripswithengine\.com$/i
| table([ComputerName, UserName, DomainName, ContextProcessId])

Q8 · DNS Resolution Confirmed by Live Network Egress to the Same C2 Host

CONF HIGHFP LOWCOST MEDIUM

Looks for: a host that both resolved the C2 domain and, from the same process, opened a network connection immediately after, confirming a live beacon rather than a passive/dead resolution. FP: low.

// HUNT: DNS Resolution Confirmed by Live Network Egress to NeedyMantis C2
// MITRE: T1071.001
// CONF: high  FP: low  COST: medium
// REQUIRES: DnsRequest, NetworkConnectIP4
// FALSE POSITIVES: none expected
#event_simpleName=DnsRequest
| DomainName=/^corp\.tripswithengine\.com$/i
| join(query={#event_simpleName=NetworkConnectIP4}, field=ContextProcessId_decimal, mode=left)
| table([ComputerName, UserName, DomainName, RemoteAddressIP4, RemotePort, ContextBaseFileName])

Q9 · Windows Service Installed Into a Documented Sideload Folder (Older-Variant Proxy)

CONF MEDIUMFP LOWCOST LOW

Looks for: a new Windows service whose ImagePath points into one of the nine documented staging folders. FP: low. Caveat: Microsoft's report describes the older (October 2025) variant's Windows-service persistence module (is) without documenting its exact install path, so this query is a defensible proxy built from the newer sample's known folders, not a literal confirmed IOC for that variant.

// HUNT: Windows Service Installed Into a Documented NeedyMantis Sideload Folder
// MITRE: T1543.003
// CONF: medium  FP: low  COST: low
// REQUIRES: CreateService
// FALSE POSITIVES: none expected for these folder names, but this is a proxy detection; the older variant's own install path is not documented by the primary source
#event_simpleName=CreateService
| ServiceImagePath=/\\(Poedit|USOShared|TightVNC\\VIM|VIM|office|broadcom|Intel|modifiable|ics)\\/i
| table([ComputerName, UserName, ServiceName, ServiceDisplayName, ServiceImagePath])

Q10 · Impacket wmiexec-Style Remote Execution (cmd.exe via services.exe)

CONF HIGHFP MEDIUMCOST LOW

Looks for: cmd.exe spawned by services.exe with the /Q /c argument pattern characteristic of Impacket's wmiexec.py/remote-service execution style, matching Microsoft's note that an operator used Impacket for hands-on-keyboard deployment. FP: medium. Some RMM and remote-management agents launch cmd.exe via a service in a similar shape.

// HUNT: Impacket wmiexec-Style Remote Execution (cmd.exe via services.exe)
// MITRE: T1047, T1569.002
// CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: some RMM/remote-management agents launch cmd.exe via a Windows service with similar arguments
// TUNING: exclude known-good RMM/management-agent service names in your environment (document the exact ParentBaseFileName/CommandLine pairs you clear) before promoting to an alert
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^services\.exe$/i
| FileName=/^cmd\.exe$/i
| CommandLine=/\/Q\s+\/c/i
| table([ComputerName, UserName, CommandLine, ParentBaseFileName, ParentProcessId])

Q11 · NeedyMantis Bundle Referenced on a UNC Network-Share Command Line

CONF HIGHFP LOWCOST LOW

Looks for: a command line that references a UNC network-share path together with one of the six spoofed DLL basenames, matching Microsoft's description of an operator copying the legitimate binary, malicious DLL, and archive from a network share for execution. FP: low. This exact combination has no legitimate business use.

// HUNT: NeedyMantis Bundle Referenced on a UNC Network-Share Command Line
// MITRE: T1570, T1021.002
// CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: none expected. A UNC path paired with one of these spoofed basenames is campaign-specific
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/\\\\.*\\(WinSparkle|libcurl|vim64|dbghelp|jli|nvml)\.dll/i
| table([ComputerName, UserName, CommandLine, ParentBaseFileName, ParentProcessId])

Q12 · Rare Fleet-Wide Execution of a NeedyMantis-Abused Legitimate Tool

CONF MEDIUMFP MEDIUMCOST LOW

Looks for: baseline execution of the four documented sideload-abused tools (Poedit, curl, Vim, TightVNC) fleet-wide, for analysts to triage against known-legitimate developer/admin populations. FP: medium to high. Many environments have legitimate Vim, curl, or TightVNC installs; use this to spot the tool appearing on a host with no business reason to run it, not as a standalone alert.

// HUNT: Rare Fleet-Wide Execution of a NeedyMantis-Abused Legitimate Tool
// MITRE: T1574.002
// CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2, SyntheticProcessRollup2
// FALSE POSITIVES: curl, Vim, and TightVNC are legitimately used by developers, sysadmins, and IT support fleets
// TUNING: exclude your known developer/admin host groups and any managed-software baseline before treating a hit as anomalous; investigate only hosts with no expected reason to run these tools
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(Poedit|curl|vim64|gvim|tvnserver)(\.exe)?$/i
| table([ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName])

CrowdStrike Custom IOA Recommendations

Promote to a Custom IOA (alert-only or blocking, as your policy allows) once each has run FP-clean over the §11 baseline window:

Candidate	Pattern	Exclusions	Deployment path
Q1: Known atomic hash	`SHA256HashData` matches one of the three published NeedyMantis hashes	None identified	Custom IOA, alert-only. Re-verify hash provenance for each new sample before adding to a blocking policy.
Q2: Documented DLL sideload combo	`TargetFileName` matches one of the nine documented folder/basename combinations	None identified	Custom IOA, strong candidate for full prevention given zero legitimate use of these exact combinations.
Q7: C2 domain DNS resolution	`DomainName` = `corp.tripswithengine.com`	None identified	Custom IOA, alert-only. Single-sourced infrastructure; re-verify liveness before any blocking decision.
Q8: DNS + live network confirmation	`DnsRequest` for the C2 domain joined to a same-process `NetworkConnectIP4`	None identified	Custom IOA, alert-only.
Q11: UNC-path bundle reference	`CommandLine` matches a UNC path followed by one of the six spoofed DLL basenames	None identified	Custom IOA, alert-only pending an FP-clean baseline.

Q3, Q4, Q5, Q6, Q9, Q10, Q12 stay as scheduled hunt/investigate queries: each carries a real (medium, or environment-dependent) false-positive population that needs local tuning before it is safe to alert on unattended.

Machine-Readable IOC Appendix

All rows below are single-sourced to the Microsoft Security blog (2026-09-28). None are shipped at action=prevent. See the prevent-posture rule in §1/§4.

Falcon IOC Management CSVbulk import, detect only

type,value,action,severity,expiration,description,tags
sha256,e842dd7642c8e04b5ec20b6393848a9c904e4832930950c16664fe7800ba382e,detect,high,2027-03-29,NeedyMantis WinSparkle.dll first-stage sideload loader,campaign:NeedyMantis
sha256,9cb68f986043a576e19d32184c583b7d8f571c7219d8dc0065dced1c13f077ef,detect,high,2027-03-29,NeedyMantis WinSparkle custom encrypted file archive,campaign:NeedyMantis
sha256,c82520eb03c084226be4eafbff46f56dca0aa8804a2a7f23a085a96afe71ef77,detect,high,2027-03-29,NeedyMantis libcurl custom encrypted file archive (older variant),campaign:NeedyMantis
domain,corp.tripswithengine.com,detect,high,2027-03-29,NeedyMantis C2 domain (HTTPS then WebSocket, port 443, URI /library/zip/),campaign:NeedyMantis
# filename encryptbase64.ps1 = NeedyMantis second-stage loader in the analyzed sample only (x64 shellcode, not a real PowerShell script). Not imported as a blockable indicator; hunt via Q5 command-line match instead; the name is documented to vary sample to sample.
# useragent firefox/21.0 = hard-coded WinINet user agent on the communications DLL. No Falcon IOC type for HTTP headers; hunt via proxy/SWG logs (§7) instead.

Documented DLL Sideload Paths9 of 9, path + basename

%ProgramFiles%\Poedit\WinSparkle.dll
%ProgramData%\USOShared\libcurl.dll
%ProgramData%\VIM\vim64.dll
%ProgramData%\TightVNC\VIM\vim64.dll
%ProgramData%\office\dbghelp.dll
%ProgramData%\broadcom\dbghelp.dll
%ProgramData%\Intel\jli.dll
%ProgramFiles%\modifiable\nvml.dll
%ProgramData%\ics\nvml.dll

Behavioral Signaturesarchive internals / C2 protocol

# Archive-internal component filenames (confirmed inside the WinSparkle archive; exact
# on-disk drop path per sample is not documented, so these are pivot/context only, not
# standalone file-based IOCs)
Configuration file: dnsapi.dll (spoofs the real Windows dnsapi.dll)
Communications module: ws2_32.dll (spoofs the real Windows ws2_32.dll; export "SystemInfo")
Shellcode/module loader: msvcrt140.dll (spoofs a Windows CRT DLL)
Second-stage loader (this sample only): encryptbase64.ps1

# Mutex naming convention (not queryable via Falcon CQL; no Mutex field in the
# process/network event model; pivot via Sysmon Event ID 6 equivalent tooling or EDR
# named-object telemetry where available)
Format: <username>-<processname>, e.g. Contoso-Poedit.exe

# C2 configuration (from the dnsapi.dll-named config blob)
C2 host: corp.tripswithengine.com
C2 port: 443
C2 URI: /library/zip/
Comms user agent: firefox/21.0

# C2 command numbers
1110  Sends computer name and username
1112  Sends a hard-coded identifier
1150  Keep alive
1020  Load module (received from C2)
1030  Unload module (received from C2)
1050 / 1150  Dispatch data to module (received from C2)
1070  Turn off active flags (received from C2)

Named Malware / Toolingattribution & lineage

Malware family: NeedyMantis (modular post-compromise C++/shellcode backdoor)
Primary operator: Storm-3069 (Microsoft designator; suspected China-nexus, not attributed to a nation-state)
Possibly related: UNC6863 (Google Threat Intelligence)
Discovery context: follow-on analysis of the DAEMON Tools supply-chain compromise (Kaspersky/Securelist); NeedyMantis itself has NOT been observed distributed via supply chain
Abused legitimate software: Poedit, curl, Vim, TightVNC; also observed masquerading Microsoft Office, Broadcom, Intel, and NVIDIA DLL components
Lateral-deployment tooling observed: Impacket (Microsoft Defender: HackTool:Win32/Impacket)
Microsoft Defender detections: TrojanDropper:Win64/NeedyMantis, Behavior:Win64/NeedyMantis

Patch / ASR / Audit Checklisthardening cross-reference

# Attack Surface Reduction rule GUIDs (Microsoft Defender); see §13 for deployment
01443614-cd74-433a-b99e-2ecdc07bfc25   Block executable files from running unless they meet a prevalence, age, or trusted list criterion
5beb7efe-fd9a-4556-801d-275e5ffc04cc   Block execution of potentially obfuscated scripts

# Microsoft-recommended mitigations (from the primary source, verbatim guidance)
[ ] Cloud-delivered protection enabled
[ ] Block at first sight enabled
[ ] EDR in block mode enabled (Microsoft Defender for Endpoint)
[ ] Network protection enabled
[ ] Automatic attack disruption configured (Microsoft Defender XDR)
[ ] Egress monitoring/blocking for corp.tripswithengine.com in place

# Deployment audit checklist
[ ] AppLocker/WDAC deny-list covers DLL loads from the nine documented ProgramData/ProgramFiles subfolders
[ ] Sysmon Event ID 7 (Image Loaded) enabled on servers/critical hosts to close the DLL-load visibility gap
[ ] SACL auditing enabled on service-creation-relevant registry/Security-log events (4697/7045)
[ ] Network segmentation limits Impacket-style lateral movement blast radius from any single compromised host

Detection Validation Gates

Gate	What to confirm
Telemetry ready	Confirm `ProcessRollup2`/`SyntheticProcessRollup2`, `PeFileWritten`, `DnsRequest`, `NetworkConnectIP4`, and `CreateService` are flowing for the target host groups before enabling any query as a scheduled search.
Benign baseline	Run Q3, Q4, Q6, Q9, Q10, Q12 over a trailing 30-day window before enabling as alerts, to size the false-positive volume per query in your own estate.
Positive tests	Confirm each query fires against a synthetic replica of its pattern (a lab file write into `%ProgramData%\office\dbghelp.dll`-shaped path for Q2, a lab `cmd.exe /Q /c whoami` spawned by a test service for Q10) before relying on it operationally. Do not detonate the live sample outside an isolated lab.
Promotion criteria	Zero false positives over the 14-day post-baseline window and CONF high → promote to a Custom IOA per §9. Anything below that bar stays a scheduled hunt query, re-reviewed at the next changelog entry.

Hardening: Tiered

TTP set: DLL sideloading via signed legitimate tools (T1574.002/T1036.005), in-process/obfuscated loader chain (T1027/T1140/T1622/T1055), HTTPS-to-WebSocket C2 with modular payload loading (T1071.001/T1573.001), Windows-service persistence in an older variant (T1543.003), and Impacket-based hands-on-keyboard lateral deployment (T1021.002/T1570/T1047/T1569.002). Primary mitigations: M1038 (Execution Prevention), M1040 (Behavior Prevention on Endpoint), M1047 (Audit), M1037 (Filter Network Traffic), M1030 (Network Segmentation), M1026 (Privileged Account Management), M1018 (User Account Management), M1042 (Disable/Remove Feature or Program).

Immediate (deploy this week)

Deploy Microsoft's own published mitigation set verbatim: enable cloud-delivered protection and block at first sight, run EDR in block mode, enable network protection, and set the two named Attack Surface Reduction rules (block executable files unless prevalence/age/trusted-list; block obfuscated scripts) to Block. Framework: MITRE M1040; Microsoft Defender ASR rule reference (cited directly in the primary source).
Block or alert on egress to corp.tripswithengine.com at your DNS resolver and web proxy/firewall. This is Microsoft's own first-listed mitigation. Framework: MITRE M1037; CIS Microsoft Windows Benchmark, network egress filtering guidance.
Enable automatic attack disruption (Microsoft Defender XDR) or the equivalent Falcon containment automation, so a confirmed hit on Q1/Q2/Q7/Q8 triggers host isolation without waiting on an analyst. Framework: MITRE M1040.

Near term (1–4 weeks)

Pilot an AppLocker/WDAC deny rule for DLL loads from the nine documented staging folders (Poedit, USOShared, VIM, TightVNC\VIM, office, broadcom, Intel, modifiable, ics under ProgramData/ProgramFiles), on a 5 to 10 endpoint ring before fleet rollout. Framework: MITRE M1038; CIS Microsoft Windows Benchmark, Application Control guidance. Compatibility note: confirm no legitimate Intel/Broadcom vendor tooling in your fleet actually installs into these exact folder names before enforcing.
Enable Sysmon Event ID 7 (Image Loaded) on servers and other critical hosts, since it is the only telemetry source, native or Falcon, that observes the DLL sideload event itself rather than the file write that precedes it. Framework: MITRE M1047; Sysmon configuration guidance (SwiftOnSecurity/Olaf Hartong baseline configs).
Restrict or inventory optional third-party tools (Poedit, TightVNC, standalone Vim/curl builds) via software asset management, installing only from a package-managed or centrally vetted source, to shrink the population of binaries an actor can abuse for sideloading. Framework: MITRE M1042. ⚠ best-practice, no single formal benchmark line covers this exact control.

Strategic (1–3 months)

Move toward WDAC in enforced mode (not audit) fleet-wide, with a maintained exception pipeline, so unsigned or unexpected DLL loads from user- or admin-writable ProgramData/ProgramFiles paths are denied by policy. Framework: MITRE M1038; Microsoft WDAC design guide.
Implement tiered admin and network segmentation to blunt the blast radius of Impacket-style lateral movement once an actor is already inside, since NeedyMantis is deployed post-compromise, not as an initial foothold. Framework: MITRE M1026, M1018, M1030.
Run a recurring hunt cadence re-executing §8's queries quarterly, given the actor's demonstrated goal of long-term, low-noise access rather than a single smash-and-grab. Framework: MITRE M1047.

Deployable Playbooks

Prerequisites (all steps): local admin/GPO management rights on target endpoints; Microsoft Defender Antivirus present and not in passive mode for the Defender-specific steps; a pilot ring defined before any fleet-wide rollout. Estimated deploy time: 1 to 2 hours for Steps 1 to 3 across a pilot ring; Steps 4 and 5 depend on your network/SIEM vendor's change process.

Step 1 – Enable Microsoft's published Attack Surface Reduction rules

What it does: Blocks low-prevalence/untrusted executable launches and obfuscated-script execution, both cited by Microsoft as mitigations for this threat. Why it works: the sideloaded first-stage DLL and its host binary are both low-prevalence in most fleets, and the second-stage loader's shellcode-in-a-script pattern trips the obfuscated-script rule.

Prerequisites: Microsoft Defender Antivirus active (passive mode acceptable if a third-party AV is primary, per Microsoft's ASR compatibility notes); pilot in Audit mode for 1 to 2 weeks if these rules are not already deployed. Reboot required: No.

PowerShell:
$ids = @(
  '01443614-cd74-433a-b99e-2ecdc07bfc25',  # Block executable files from running unless they meet a prevalence, age, or trusted list criterion
  '5beb7efe-fd9a-4556-801d-275e5ffc04cc'   # Block execution of potentially obfuscated scripts
)
Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions Enabled,Enabled
Write-Output "ASR rules set to Block"

GPO path:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus >
Microsoft Defender Exploit Guard > Attack Surface Reduction > Configure Attack Surface Reduction rules
(add each GUID above with value 1 = Block; use 2 = Audit for the pilot ring)

Verify:
$i = (Get-MpPreference).AttackSurfaceReductionRules_Ids
$a = (Get-MpPreference).AttackSurfaceReductionRules_Actions
for ($n=0; $n -lt $i.Count; $n++) { "$($i[$n]) => $($a[$n])" }
# Expect: 1 (Block) for each of the two GUIDs above

Monitor for false positives:
Event ID 1121 (Block) / 1122 (Audit) in Microsoft-Windows-Windows Defender/Operational.
If a legitimate internal tool trips it, add a targeted exclusion:
Add-MpPreference -AttackSurfaceReductionOnlyExclusions 'C:\Path\To\LegitimateTool.exe'

Rollback:
Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions Disabled,Disabled

Step 2 – Enable cloud-delivered protection, EDR block mode, and network protection

What it does: Turns on the three remaining Microsoft-recommended baseline controls: rapid cloud lookup of new/unknown variants, EDR-driven remediation of malicious artifacts even when a non-Microsoft AV is primary, and network-layer blocking of known-malicious connections. Why it works: covers the case where a NeedyMantis variant's specific hash or path is not yet in a static signature.

Prerequisites: Microsoft Defender Antivirus/Defender for Endpoint licensed and installed. Reboot required: No.

PowerShell:
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendAllSamples
Set-MpPreference -DisableBlockAtFirstSeen $false
Set-MpPreference -EnableNetworkProtection Enabled

# EDR in block mode is a Microsoft Defender for Endpoint tenant setting:
# Settings > Endpoints > Advanced features > "Enable EDR in block mode" = On
Write-Output "Cloud protection, block-at-first-sight, and network protection enabled"

Verify:
Get-MpPreference | Select-Object MAPSReporting, DisableBlockAtFirstSeen, EnableNetworkProtection
# Expect: MAPSReporting=2 (Advanced), DisableBlockAtFirstSeen=False, EnableNetworkProtection=1 (Enabled)

Rollback:
Set-MpPreference -MAPSReporting Basic
Set-MpPreference -DisableBlockAtFirstSeen $true
Set-MpPreference -EnableNetworkProtection Disabled

Step 3 – Block C2 egress at DNS/firewall

What it does: Stops resolution of, or connectivity to, corp.tripswithengine.com, Microsoft's own first-listed mitigation. Why it works: removes the C2 channel even if the loader chain runs successfully on a host.

Prerequisites: DNS Response Policy Zone (RPZ) support on your internal resolver, or equivalent firewall/SWG policy-authoring rights. Reboot required: No.

Windows DNS Server (RPZ) PowerShell:
Add-DnsServerQueryResolutionPolicy -Name "Block-NeedyMantis-C2" `
  -Action IGNORE `
  -FQDN "EQ,corp.tripswithengine.com"

Generic firewall/SWG rule (illustrative; adapt to your platform):
Deny outbound TCP/443 where destination FQDN/SNI = corp.tripswithengine.com

Verify:
Resolve-DnsName corp.tripswithengine.com -ErrorAction SilentlyContinue
# Expect: resolution failure or a sinkhole address from an internal, non-production test host

Rollback:
Remove-DnsServerQueryResolutionPolicy -Name "Block-NeedyMantis-C2"
# or remove the equivalent firewall/SWG rule

Step 4 – AppLocker/WDAC deny rule for the nine documented sideload paths

What it does: Denies DLL loads from the nine Microsoft-published folder/basename combinations. Why it works: breaks the chain at the exact point where the malicious DLL would otherwise be sideloaded by its legitimate host binary.

Prerequisites: AppLocker (or WDAC) available (Windows 10/11 Enterprise or Education for full policy flexibility); confirm no legitimate Intel/Broadcom/Office-adjacent tooling in your fleet installs into these exact folder names before enforcing. Reboot required: No (AppLocker policy refresh via gpupdate is sufficient); the Application Identity service must be running.

PowerShell (create + test in Audit mode first):
New-AppLockerPolicy -RuleType Publisher,Path -User Everyone -RuleNamePrefix "DenyNeedyMantisSideload" `
  -XmlPolicy | Set-AppLockerPolicy -Merge

# Minimal deny-path rules (adapt via the AppLocker MMC snap-in for a maintained policy):
# Deny DLL execution matching each of:
#   %ProgramFiles%\Poedit\WinSparkle.dll        %ProgramData%\USOShared\libcurl.dll
#   %ProgramData%\VIM\vim64.dll                  %ProgramData%\TightVNC\VIM\vim64.dll
#   %ProgramData%\office\dbghelp.dll             %ProgramData%\broadcom\dbghelp.dll
#   %ProgramData%\Intel\jli.dll                  %ProgramFiles%\modifiable\nvml.dll
#   %ProgramData%\ics\nvml.dll

Verify (Audit mode first):
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" -MaxEvents 20

Rollback:
Set-AppLockerPolicy -XmlPolicy "C:\Path\To\PreviousPolicy.xml"
# or remove the rule collection: Remove-AppLockerPolicy (if fully rolling back AppLocker)

Step 5 – Enable Sysmon Event ID 7 (Image Loaded) on servers and critical hosts

What it does: Logs every DLL/image load, closing the one visibility gap this pack cannot cover natively: Falcon's own event model does not expose a generic DLL-load event, so the actual sideload moment is only visible through Sysmon. Why it works: gives SIEM/SOAR a second, independent detection path for the exact technique this campaign relies on.

Prerequisites: Sysmon installed (via Microsoft Sysinternals); a maintained config that enables Event ID 7 with appropriate DLL-path/hash filtering to control log volume (unfiltered Event ID 7 is extremely high-volume). Reboot required: No.

Sysmon config snippet (merge into your existing sysmonconfig.xml):
<ImageLoad onmatch="include">
  <ImageLoaded condition="end with">WinSparkle.dll</ImageLoaded>
  <ImageLoaded condition="end with">libcurl.dll</ImageLoaded>
  <ImageLoaded condition="end with">vim64.dll</ImageLoaded>
  <ImageLoaded condition="end with">dbghelp.dll</ImageLoaded>
  <ImageLoaded condition="end with">jli.dll</ImageLoaded>
  <ImageLoaded condition="end with">nvml.dll</ImageLoaded>
</ImageLoad>

Deploy:
sysmon64.exe -c updated-sysmonconfig.xml

Verify:
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" -FilterXPath "*[System[EventID=7]]" -MaxEvents 5
sysmon64.exe -c
# Confirm the ImageLoad rule block above is present in the active config dump

Rollback:
sysmon64.exe -c previous-sysmonconfig.xml
# or remove the ImageLoad block and redeploy the prior config

Containment Runbook

Phase	Actions	Owner	Evidence to capture
1 – Triage	Confirm the trigger (Q1/Q2 known-artifact hit, Q7/Q8 C2 hit, or Q10/Q11 Impacket-pattern hit). Pull the full process tree for the sideloaded host binary, the file-write timeline for the archive/DLL, and any network connections from the affected process.	SOC L1/L2	Falcon process-timeline export; `TargetFileName`/`SHA256HashData` captures; network connection log
2 – Contain	Network-isolate the host from the Falcon console. Kill the process tree for the sideloaded binary. Block `corp.tripswithengine.com` at the perimeter resolver/firewall (single-sourced; document the decision per your IOC-confidence policy). Given NeedyMantis is a post-compromise tool, assume broader access exists and scope the investigation beyond this one host: check for the same three-part bundle on other hosts reachable from the network share it was staged from.	IR lead	Isolation timestamp; kill confirmation; firewall/DNS change ticket; scope-expansion notes
3 – Eradicate	Delete the sideloaded DLL, its custom archive, and the extracted second-stage/main-component artifacts from all nine documented staging folders found populated. Remove any Windows service created by the older-variant persistence module. Reboot to fully clear any loaded modules from memory.	IR / endpoint engineering	Before/after file-system listing; service-removal log; reboot confirmation
4 – Recover	Re-verify clean via a full Falcon/AV scan. Reset credentials for any account whose session touched the affected host, given the recon data (computer name, username, process list) already exfiltrated in the initial beacon cookie. Re-enable network access only after a 14-day clean monitoring window.	IR + Helpdesk	Scan report; credential-reset ticket; monitoring-window sign-off
5 – Post-incident	Retro-hunt the full fleet with Q1, Q2, Q7, Q8, Q11 over a 90-day lookback, since NeedyMantis's stated purpose is long-term access rather than a single-host compromise. Cross-check for other Impacket-pattern activity (Q10) originating from the same source host or account. File a §17 changelog entry and brief stakeholders on findings.	Threat hunt team	Retro-hunt results; lateral-movement scope summary; changelog entry

Detection Coverage Map

Attack-chain step	Behavior	CQL	IOA	Coverage
1	Actor already has network access (pre-condition, not a NeedyMantis behavior)	N/A	N/A	N/A: out of scope for this pack
2	Bundle staged, in one case copied from a network share via Impacket	Q10, Q11	Q11 candidate	Good
3	Legitimate binary sideloads the malicious first-stage DLL	Q1, Q2, Q3	Q1, Q2 candidates	Good
4	First-stage loader extracts and runs the second-stage loader in-process	Q5 (sample-specific filename only)	N/A	GAP: in-process extraction/execution is not independently visible via Falcon CQL fields
5	Second-stage shellcode decodes and loads the main component	N/A	N/A	GAP: in-memory only
6	Mutex creation; initial HTTPS beacon with recon data in Set-Cookie	Q7	Q7 candidate	Partial: the beacon itself is visible (Q7); mutex creation and cookie contents are a GAP
7	Upgrade to WebSocket; RC4 key exchange; binary C2 protocol	Q8	Q8 candidate	Good for the network effect; GAP for the protocol internals
8	Operator loads/unloads modules over the C2 channel	N/A	N/A	GAP: capability-level, no artifact distinct from the already-covered C2 channel (step 7)
9	Older-variant Windows-service persistence module ("is")	Q9 (folder-based proxy)	N/A	Partial: proxy detection only; the variant's own service name/path is not documented by the primary source

3 of 9 chain steps carry an honest GAP rating, and 2 more are Partial. All of the gapped behavior is in-memory/in-process (mutex creation, shellcode execution, cookie-encoded recon, module load/unload) that Falcon's standard event model does not expose as a queryable field, by design. This pack compensates by detecting the deterministic artifacts each gapped step leaves behind (file writes, path anomalies, network egress, service creation) rather than the step itself. Validation-gate criteria for the queries covering the Good/Partial rows are in §11.

Hunt Summary Ticket

TITLE:      NeedyMantis / Storm-3069 Post-Compromise Backdoor
SEVERITY:   High
SCOPE:      Windows endpoints; Falcon LTR/NG-SIEM: ProcessRollup2, SyntheticProcessRollup2,
            PeFileWritten, DnsRequest, NetworkConnectIP4, CreateService
HYPOTHESIS: A previously compromised host was staged with a three-part NeedyMantis bundle
            (legitimate signed tool + malicious sideload DLL + encrypted custom archive),
            possibly via Impacket from a network share, establishing a modular backdoor that
            beacons HTTPS then WebSocket (RC4-encrypted) to corp.tripswithengine.com:443.
QUERIES:    Q1-Q12 (Section 8); IOA candidates Q1, Q2, Q7, Q8, Q11 (Section 9)
DO FIRST:   Run Q1 (known hash) and Q2 (documented DLL sideload combo) environment-wide over
            a 90-day window. Any hit = confirmed compromise; escalate to IR immediately per
            Section 14. NeedyMantis is post-compromise; a hit means broader access exists.
FINDINGS:   [populate post-hunt]
GAPS:       Mutex creation, second-stage shellcode execution, cookie-encoded recon exfiltration,
            RC4 protocol internals, and module load/unload capabilities are not independently
            visible in Falcon CQL telemetry (Section 15). Every atomic IOC in this pack traces
            to exactly one public source (Microsoft Security, 2026-09-28); none are promoted
            to a prevent/blocking posture (Section 1/4/12).
ACTIONS:    See Containment Runbook, Section 14.
OWNER:      HuntPack
VERSION:    v0.1 · 2026-09-29

Changelog

v0.12026-09-29Initial pack build. Primary source: Microsoft Security Blog (2026-09-28). Corroborating: The Hacker News, Cyber Kendra (both syndicated summaries of the same Microsoft report, not independent research). 12 CQL hunt queries covering the documented DLL sideload paths, C2 infrastructure, older-variant service persistence, and observed Impacket lateral-deployment patterns; 3 full and 2 partial honest coverage gaps for in-memory/in-process behavior. All atomic IOCs single-sourced; shipped as detect/hunt/enrich, none as prevent.

References

Tier	Source	Used For	Access Date
T1	Microsoft Security Blog: NeedyMantis: Unpacking a post-compromise malware family used in targeted operations	Primary technical analysis; every atomic IOC in this pack	2026-09-29
T2	The Hacker News: Hackers Use NeedyMantis to Maintain Long-Term Access in Breached Networks	Corroborating summary; media-pickup confirmation only	2026-09-29
T3	Cyber Kendra: Microsoft Details NeedyMantis Post-Compromise Malware	Corroborating aggregator summary	2026-09-29
N/A	MITRE ATT&CK	Technique IDs throughout §6	2026-09-29

Source snapshots saved verbatim under NeedyMantis-Storm3069-Hunt-sources/ alongside this file: 01-microsoft-advisory.txt, 02-thn.txt, 03-cyberkendra.txt.