Emerging Threathightest

Potential Pikabot Hollowing Activity

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Andreas Braathen (mnemonic.io)Created Fri Oct 27Updated Fri Jan 26d8937fe7-42d5-4b4d-8178-e089c908f63f2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith:
            # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
            - '\SearchFilterHost.exe'
            - '\SearchProtocolHost.exe'
            - '\sndvol.exe'
            - '\wermgr.exe'
            - '\wwahost.exe'
    filter_main_legit_sndvol:
        Image|endswith: '\sndvol.exe'
        ParentCommandLine|contains: 'mmsys.cpl'
    condition: selection and not 1 of filter_main_*