NeedyMantis Persistence Malware: Detection and Hunting Guide for Telecom, Healthcare, and Government Networks

---
title: Suspicious Windows Service Persistence — Non-Standard Binary Path
id: 8f2e4a71-3b6c-4d9e-b1a7-9c4f2e8d5a31
status: experimental
description: Detects creation of Windows services whose binary path resides in user-writable or non-standard directories, a common persistence technique for implants such as NeedyMantis that masquerade as legitimate services.
references:
  - https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html
  - https://attack.mitre.org/techniques/T1543/003/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_tool:
    Image|endswith:
      - '\sc.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'create'
      - 'binpath'
  selection_path:
    CommandLine|contains:
      - 'C:\\Users\\'
      - 'C:\\ProgramData\\'
      - 'C:\\Windows\\Temp\\'
      - 'C:\\Temp\\'
      - 'AppData\\'
  filter_common:
    CommandLine|contains:
      - 'C:\\ProgramData\\Microsoft\\'
      - 'C:\\ProgramData\\Package Cache\\'
  condition: selection_tool and selection_path and not filter_common
falsepositives:
  - Legitimate software installers registering services from ProgramData
  - IT deployment tooling
level: high
---
title: Scheduled Task Created Masquerading as System or Vendor Task
id: 2c7b9d14-6e3a-4f81-a5c2-7d1e9b4a6f83
status: experimental
description: Detects scheduled task creation referencing executables in user-profile, Temp, or ProgramData locations — a persistence pattern consistent with long-term implants such as NeedyMantis.
references:
  - https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.persistence
  - attack.privilege_escalation
  - attack.t1053.005
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\schtasks.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - '/create'
      - 'Register-ScheduledTask'
  selection_suspicious_path:
    CommandLine|contains:
      - 'C:\\Users\\'
      - 'AppData\\'
      - 'C:\\Windows\\Temp\\'
      - 'C:\\Temp\\'
  filter_known:
    CommandLine|contains:
      - 'C:\\Users\\*\\AppData\\Local\\Microsoft\\Teams\\'
  condition: selection and selection_suspicious_path and not filter_known
falsepositives:
  - User-context application updaters (browsers, Teams, Slack)
  - Developer tooling
level: medium
---
title: Rare Outbound HTTPS Connection from Non-Browser Process on Server
id: 4a1d8f62-9c5b-4e37-b2d8-6f3a1c7e9d24
status: experimental
description: Detects network connections to uncommon external destinations from processes that are not browsers or sanctioned agents — hunting logic for low-and-slow C2 beaconing characteristic of long-term implants like NeedyMantis.
references:
  - https://thehackernews.com/2026/09/hackers-use-needymantis-to-maintain.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort:
      - 443
      - 8443
    Initiated: 'true'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\iexplore.exe'
  filter_agents:
    Image|contains:
      - '\Windows Defender\\'
      - '\Microsoft\\'
      - '\CrowdStrike\\'
      - '\SentinelOne\\'
  condition: selection and not filter_browsers and not filter_agents
falsepositives:
  - EDR, backup, and monitoring agents — build an allowlist of sanctioned agent paths
  - Line-of-business application updaters
level: medium

let Lookback = 14d;
DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("sc.exe", "schtasks.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("create", "binpath", "Register-ScheduledTask")
| where ProcessCommandLine has_any (@"C:\Users\", @"C:\ProgramData\", @"\AppData\", @"C:\Windows\Temp\")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportId
| sort by TimeGenerated desc

let Lookback = 14d;
let KnownAgentPaths = dynamic([@"\Program Files\Microsoft\", @"\Program Files\CrowdStrike\", @"\Program Files\SentinelOne\", @"\Windows\System32\svchost.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemotePort in (443, 8443)
| where ActionType == "ConnectionSuccess"
| where not(InitiatingProcessFolderPath has_any (KnownAgentPaths))
| where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe")
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by RemoteUrl, InitiatingProcessFileName, DeviceName
| summarize HostCount = dcount(DeviceName), TotalConnections = sum(Connections),
            Processes = make_set(InitiatingProcessFileName), Earliest = min(FirstSeen)
    by RemoteUrl
| where HostCount <= 2 and TotalConnections > 20
| sort by HostCount asc, TotalConnections desc

let Lookback = 7d;
DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where FolderPath has_any (@"C:\ProgramData\", @"\AppData\Local\Temp\", @"C:\Windows\Temp\")
| where FileName endswith ".exe"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | project ProcessTime = TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256
) on DeviceName, FileName
| project FileCreateTime = TimeGenerated, ProcessTime, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, SHA256
| sort by FileCreateTime desc

-- Hunt: Persistence implant sweep — services/tasks with binaries in user-writable paths
-- Consistent with NeedyMantis-style long-term access implants

LET services = SELECT Name, DisplayName, PathName, StartName, State
FROM wmi(query="SELECT Name, DisplayName, PathName, StartName, State FROM Win32_Service")
WHERE PathName =~ '(?i)\\\\(Users|ProgramData|Windows\\\\Temp|Temp)\\\\'
   AND NOT PathName =~ '(?i)Package Cache|Microsoft\\\\VisualStudio|Microsoft OneDrive'

LET taskfiles = SELECT Mtime AS ModTime, Size, FullPath
FROM glob(globs='C:/Windows/System32/Tasks/**/*', accessor='ntfs')
WHERE ModTime > Now() - 1209600  -- modified in last 14 days

SELECT * FROM services

-- Hunt: Processes executing from non-standard paths with established external connections
-- Candidate implant beaconing review

LET suspicious = SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Exe =~ '(?i)\\\\(Users|ProgramData|Windows\\\\Temp)\\\\'
   AND NOT Exe =~ '(?i)OneDrive|Teams|Slack|Zoom|Google\\\\Chrome|AppData\\\\Local\\\\Programs'

SELECT suspicious.Pid AS Pid,
       suspicious.Name AS Process,
       suspicious.Exe AS Binary,
       suspicious.Username AS User,
       netstat().RaddrIP AS RemoteIP,
       netstat().RaddrPort AS RemotePort,
       netstat().Status AS ConnState
FROM suspicious
JOIN netstat() ON suspicious.Pid = netstat().Pid
WHERE netstat().Status =~ 'ESTAB'
   AND netstat().RaddrIP !~ '^(10\\.|172\\.(1[6-9]|2[0-9]|3[01])\\.|192\\.168\\.|127\\.)'

# NeedyMantis Persistence Surface Audit — Run as Administrator
# Output: CSV inventory of suspicious persistence artifacts for IR review
# NOTE: This script COLLECTS evidence. It does not delete anything.

$OutDir = "C:\IR-Collection\$env:COMPUTERNAME"
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
$SuspiciousRoots = @('C:\Users\','C:\ProgramData\','C:\Windows\Temp\','C:\Temp\','\AppData\')
$Allowlist = @('Package Cache','Microsoft\OneDrive','Microsoft\Teams','Microsoft\VisualStudio')

# 1. Services with binaries in user-writable paths
Write-Host "[*] Auditing services..." -ForegroundColor Cyan
Get-CimInstance Win32_Service | ForEach-Object {
    $path = $_.PathName
    if ($path -and ($SuspiciousRoots | Where-Object { $path -like "*$_*" })) {
        if (-not ($Allowlist | Where-Object { $path -like "*$_*" })) {
            [PSCustomObject]@{
                Type = 'Service'; Name = $_.Name; DisplayName = $_.DisplayName
                Path = $path; RunAs = $_.StartName; State = $_.State; StartMode = $_.StartMode
            }
        }
    }
} | Export-Csv "$OutDir\services-suspicious.csv" -NoTypeInformation

# 2. Scheduled tasks executing from non-standard locations
Write-Host "[*] Auditing scheduled tasks..." -ForegroundColor Cyan
Get-ScheduledTask | ForEach-Object {
    $task = $_
    $_.Actions | Where-Object { $_.Execute } | ForEach-Object {
        $exe = $_.Execute
        if ($SuspiciousRoots | Where-Object { $exe -like "*$_*" }) {
            if (-not ($Allowlist | Where-Object { $exe -like "*$_*" })) {
                [PSCustomObject]@{
                    Type = 'ScheduledTask'; Name = $task.TaskName; Path = $exe
                    Arguments = $_.Arguments; State = $task.State; UserId = $task.Principal.UserId
                }
            }
        }
    }
} | Export-Csv "$OutDir\tasks-suspicious.csv" -NoTypeInformation

# 3. Run key / RunOnce entries pointing outside Program Files
Write-Host "[*] Auditing registry Run keys..." -ForegroundColor Cyan
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce'
)
foreach ($key in $RunKeys) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Name -notmatch '^PS' -and $_.Value -notmatch 'Program Files'
        } | ForEach-Object {
            [PSCustomObject]@{ Type = 'RunKey'; Key = $key; Name = $_.Name; Value = $_.Value }
        }
    }
} | Export-Csv "$OutDir\runkeys-audit.csv" -NoTypeInformation

# 4. Unsigned executables running from non-standard paths (live processes)
Write-Host "[*] Auditing running processes..." -ForegroundColor Cyan
Get-Process | Where-Object { $_.Path } | ForEach-Object {
    $p = $_.Path
    if ($SuspiciousRoots | Where-Object { $p -like "*$_*" }) {
        if (-not ($Allowlist | Where-Object { $p -like "*$_*" })) {
            $sig = Get-AuthenticodeSignature $p -ErrorAction SilentlyContinue
            [PSCustomObject]@{
                Type = 'Process'; Name = $_.ProcessName; PID = $_.Id; Path = $p
                SignatureStatus = $sig.Status; Signer = $sig.SignerCertificate.Subject
            }
        }
    }
} | Export-Csv "$OutDir\processes-suspicious.csv" -NoTypeInformation

# 5. Recent executable drops in staging directories (last 30 days)
Write-Host "[*] Scanning for recent executable drops..." -ForegroundColor Cyan
Get-ChildItem 'C:\ProgramData','C:\Windows\Temp' -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue |
    Where-Object { $_.CreationTime -gt (Get-Date).AddDays(-30) } |
    Select-Object FullName, CreationTime, LastWriteTime, Length |
    Export-Csv "$OutDir\recent-drops.csv" -NoTypeInformation

Write-Host "[+] Collection complete: $OutDir" -ForegroundColor Green
Write-Host "[!] PRESERVE these artifacts. Escalate anomalies to IR before remediation." -ForegroundColor Yellow