Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
6
1
Categories
5
2
2
1
1
Platforms
6
1
Products / Services
5
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects potential command-and-control (C2) communication associated with the Pikabot malware. The detection looks for outbound HTTP POST requests to external networks that lack a 'Content-Type' header and contain a non-empty, specifically sized request body, which are behavioral indicators consistent with Pikabot beaconing activity.
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries.
Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity. The rule looks for rundll32.exe being spawned by common scripting or execution processes (cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, wscript.exe) and executing a file in common temporary or user-writable directories (ProgramData, Users\Public, Windows\Installer, AppData\Local\Temp, AppData\Roaming) where the file being executed does not have a standard DLL, CPL, or INF extension.
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects system discovery activity carried out by Pikabot, such as network, user information, and domain groups. The malware Pikabot has been observed using this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute). The rule specifically looks for `ipconfig.exe /all`, `netstat.exe -aon`, and `whoami.exe /all` commands executed by processes whose grandparent image ends with `rundll32.exe` or parent image ends with `SearchFilterHost.exe` or `SearchProtocolHost.exe`.