Potential Pikabot Discovery Activity
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Definition
Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule
detection:
selection_parent:
- GrandParentImage|endswith: '\rundll32.exe'
- ParentImage|endswith:
- '\SearchFilterHost.exe'
- '\SearchProtocolHost.exe'
selection_child:
CommandLine:
# Note: Only add strings as seen used by Pikabot to avoid collision with other strains of malware
- 'ipconfig.exe /all'
- 'netstat.exe -aon'
- 'whoami.exe /all'
condition: all of selection_*False positives are unlikely for most environments. High confidence detection.
Tactics
Techniques
Other