Pikabot Fake DLL Extension Execution Via Rundll32.EXE
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity. The rule looks for rundll32.exe being spawned by common scripting or execution processes (cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, wscript.exe) and executing a file in common temporary or user-writable directories (ProgramData, Users\Public, Windows\Installer, AppData\Local\Temp, AppData\Roaming) where the file being executed does not have a standard DLL, CPL, or INF extension.
Sigma
