Trickbot Indicators in Process Command Line

Ankit Mehta@Secvyn

•updated Jun 17, 2026•0•0•0

Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.