--- analysis: A single rule for WinSparkle.dll or libcurl.dll creates noise when these apps are legitimately updated. This hunt correlates the unusual placement (ProgramData), the execution context (sideloading into a legitimate app), and the external network signal to achieve high-fidelity detection that a rule cannot provide. blind_spots: - id: websocket-visibility-gap owner: network-team question: Whether the persistent TCP traffic is an authenticated WebSocket stream remediation: Enable WebSocket protocol logging on the perimeter proxy or firewall. requires: Deep packet inspection with WebSocket protocol parsing risk: Without protocol awareness, persistent 443 traffic might be dismissed as standard encrypted browser traffic or update checks. stage: c2-websockets-communication - id: archive-content-visibility owner: endpoint-engineering question: What files are contained within the staged extensionless archives remediation: Implement sandbox detonation for extensionless archives found in ProgramData. requires: Decompression and decryption capability on the host risk: The framework stages its second and third components inside an encrypted archive that hb_file_activity cannot see inside. stage: lateral-movement-impacket-deployment coverage: - stage: lateral-movement-impacket-deployment status: covered steps: - impacket-deployment-file-writes - stage: dll-sideloading-execution status: covered steps: - sideloaded-module-execution - module-rarity-baseline - stage: c2-websockets-communication status: covered steps: - c2-dns-resolution - reason: Not examined by this hunt; belongs to a separate hunt. stage: archive-extraction-and-payload-load status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: keep-as-periodic-hunt justification: NeedyMantis is a specialized framework for long-term persistence used in targeted operations. Detecting the sideloading and C2 early is the only way to prevent follow-on modular functionality and data theft. methodology: model-assisted trigger: intel-report hypothesis: An adversary has established long-term access by sideloading modular components into legitimate processes like Poedit or Vim, using encrypted archives staged in unusual directories to bypass detection. labels: - hunt - attack.t1574.002 - attack.t1071.001 - attack.t1021.002 - command and control - defense evasion - execution - lateral movement name: NeedyMantis Modular Sideloading and WebSocket C2 parameters: c2_domains: default: - corp.tripswithengine.com description: Identified C2 domains for NeedyMantis. from: kind: article observed: '2026-09-28' ref: msrc-blog type: list[domain] lookback_days: default: '14' description: Days of history to examine. type: number scope_hosts: default: [] description: Optional list of hostnames to scope the hunt; if empty, the whole estate is scanned. type: list[host] target_dlls: default: - winsparkle.dll - libcurl.dll - vim64.dll - dbghelp.dll - jli.dll - nvml.dll description: Malicious DLL names used by the framework for sideloading. from: kind: article observed: '2026-09-28' ref: msrc-blog type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Start the hunt by examining workstations that run Poedit, Vim, or curl, particularly in developer and administrative groups. references: - name: "MSRC Blog \u2014 NeedyMantis: Unpacking a post-compromise malware family" url: https://www.microsoft.com/en-us/security/blog/2026/09/28/needymantis-unpacking-a-post-compromise-malware-family-used-in-targeted-operations/ related: - hunt: archive-extraction-and-payload-load reason: This hunt focuses on the initial deployment and C2; parsing the custom archive format and shellcode loading is handled in the deeper forensic sequel. relation: out-of-scope-alternative scenario: stages: - name: Lateral movement and tool deployment observables: - Impacket toolkit usage - copying WinSparkle.dll from network share - copying libcurl.dll from network share - files placed in %ProgramFiles%\Poedit - files placed in %ProgramData%\USOShared - files placed in %ProgramData%\VIM slug: lateral-movement-impacket-deployment tactic: lateral-movement techniques: - T1021.002 - name: DLL sideloading of legitimate software observables: - Poedit.exe loading WinSparkle.dll - curl.exe loading libcurl.dll - vim.exe loading vim64.dll - TightVNC.exe loading vim64.dll - nvml.dll - dbghelp.dll - jli.dll slug: dll-sideloading-execution tactic: execution techniques: - T1574.002 - name: Encrypted archive extraction and modular loading observables: - extensionless archive files (WinSparkle, libcurl) - encryptbase64.ps1 - dnsapi.dll (malicious config) - ws2_32.dll (malicious C2 component) - msvcrt140.dll (malicious loader) - 'mutex: - (e.g., Contoso-Poedit.exe)' slug: archive-extraction-and-payload-load tactic: defense-evasion techniques: - T1027 - T1059.001 - name: WebSockets Command and Control observables: - corp.tripswithengine.com - port 443 - 'URL path: /library/zip/' - WebSockets communication protocol - SystemInfo export usage slug: c2-websockets-communication tactic: command-and-control techniques: - T1071.001 summary: China-linked threat actors use the modular NeedyMantis framework for post-compromise persistence in targeted sectors. The malware is deployed via lateral movement tools like Impacket and leverages DLL sideloading in common applications like Poedit and Vim to load encrypted archives containing C2 and modular components. severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # NeedyMantis Modular Sideloading and WebSocket C2 NeedyMantis is a modular framework observed in targeted operations against government and telecommunications sectors. It relies on DLL sideloading within common software and maintains a persistent WebSocket-based connection for command and control. This hunt identifies the framework by tracing the initial file deployment via Impacket-style patterns, confirming the execution through rare module loads from non-standard paths, and identifying the low-prevalence DNS resolution of known C2 infrastructure. ## impacket-deployment-file-writes Identify the initial placement of the sideloading DLLs and accompanying archives in ProgramData or Program Files subfolders, mimicking the lateral movement observed in the report. ```sqlite target=endpoint role=scoping params=(target_dlls=target_dlls, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: A row showing a DLL like WinSparkle.dll or libcurl.dll being written to ProgramData. Silence indicates no obvious staging of these components was captured. reads: - activity_id - actor_user_name - device_hostname - file_name - file_path - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE (activity_id = 1 OR activity_id = 3) AND (LOWER(file_path) LIKE '%\\programdata\\%' OR LOWER(file_path) LIKE '%\\users\\public\\%' OR LOWER(file_path) LIKE '%\\program files\\poedit\\%' OR LOWER(file_path) LIKE '%\\program files\\vim\\%') AND instr(',' || '{{target_dlls}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## parallel-evidence parallel: - → sideloaded-module-execution - → c2-dns-resolution - → module-rarity-baseline join: → triage-agent ## sideloaded-module-execution Confirm that the target processes (Poedit, curl, etc.) are actually loading the masquerading DLLs from unusual paths. ```sqlite target=endpoint role=detection-candidate params=(target_dlls=target_dlls, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: A legitimate process loading a DLL from a path where it does not normally reside. This is the core behavioral indicator of NeedyMantis. reads: - device_hostname - module_name - module_path - process_name - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, process_name, module_name, module_path, time FROM hb_module_activity WHERE instr(',' || '{{target_dlls}}' || ',', ',' || LOWER(module_name) || ',') > 0 AND (LOWER(module_path) LIKE '%\\programdata\\%' OR LOWER(module_path) LIKE '%\\users\\public\\%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## c2-dns-resolution Match the host activity to the known NeedyMantis C2 domain to confirm the nature of the infection. ```sqlite target=endpoint role=enrichment params=(c2_domains=c2_domains, scope_hosts=scope_hosts, lookback_days=lookback_days) ~~~yaml expected: Resolution of corp.tripswithengine.com, specifically originating from a process involved in the sideloading branch. reads: - device_hostname - process_name - query_hostname - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE instr(',' || '{{c2_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## module-rarity-baseline Stack-count the identified modules to ensure the signal is not fleet-wide noise from a standard administrative tool. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A low host count for the specific module names identifies the targeted nature of the payload. prevalence: by: device_hostname key: - module_name rare_below: 3 reads: - device_hostname - module_name - module_path - time silence: not_evidence_of_absence source: hb_module_activity verified: dry-run verified_at: '2026-09-29' ~~~ SELECT LOWER(module_name) as name, COUNT(DISTINCT device_hostname) as host_count FROM hb_module_activity WHERE (LOWER(module_path) LIKE '%\\programdata\\%' OR LOWER(module_path) LIKE '%\\users\\public\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1 HAVING host_count <= 3 ``` ## triage-agent ```agent target=hunter cite: required context: - impacket-deployment-file-writes - sideloaded-module-execution - c2-dns-resolution - module-rarity-baseline max_iterations: 5 objective: Determine if any host shows the correlated pattern of a WinSparkle, libcurl, or vim64 module load from ProgramData alongside DNS resolution to the identified C2 domain. success_criteria: A verdict of malicious | suspicious | benign per host. tools: - endpoint ``` ## route-on-verdict if~: "the triage-agent verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → isolate-endpoint indeterminate: → forensic-payload-analysis unavailable: → forensic-payload-analysis (blind_spot: websocket-visibility-gap) else: → hunt-closeout ## isolate-endpoint ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and preserve the ProgramData directory for forensic collection. ``` → forensic-payload-analysis ## forensic-payload-analysis ```manual target=analyst Identify the extensionless archive matching the loader DLL name. Attempt to XOR-decode and decompress the archive to recover the second-stage loader and communications DLL. Check for the SystemInfo export. ``` → hunt-closeout ## hunt-closeout ```manual target=analyst Record all confirmed malicious paths and the account involved in the initial file write. Determine if the module-loading detection candidate can be promoted to a rule for specific sensitive environments. ``` → end