Sigma rule: Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Rule

Title

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Status

test

Level

high

Author

Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)

Date

2024-01-26

File

rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Log source

product

windows

category

process_creation

Detection

selection:
    ParentImage|endswith:
        - '\cmd.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\wscript.exe'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - ':\ProgramData\'
        - ':\Users\Public\'
        - ':\Windows\Installer\'
        - '\AppData\Local\Temp\'
        - '\AppData\Roaming\'
filter_main_known_extension:
    - CommandLine|contains:
          - '.cpl '
          - '.cpl,'
          - '.dll '
          - '.dll,'
          - '.inf '
          - '.inf,'
    - CommandLine|endswith:
          - '.cpl'
          - '.cpl"'
          - '.dll'
          - '.dll"'
          - '.inf'
          - '.inf"'
          - ".cpl'"
          - ".dll'"
          - ".inf'"
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• detection.emerging-threats
• attack.stealth

References

• https://github.com/pr0xylife/Pikabot
• https://tria.ge/231004-tp8k6sch9t/behavioral2
• https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
• https://tria.ge/231212-r1bpgaefar/behavioral2

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_uncommon_extension.yml