Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•27

Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.