Sigma rule: Potential Pikabot C2 Activity

Rule

Title

Potential Pikabot C2 Activity

Status

test

Level

high

Author

Andreas Braathen (mnemonic.io)

Date

2023-10-27

Modified

2024-01-26

File

rules-emerging-threats/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Log source

product

windows

category

network_connection

definition

Requirements: By default the network_connection type event might not contain the ParentImage. Make sure you collect such fields in order to use this rule

Detection

selection:
    ParentImage|endswith: '\rundll32.exe'
    Image|endswith:
        # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
        - '\SearchFilterHost.exe'
        - '\SearchProtocolHost.exe'
        - '\sndvol.exe'
        - '\wermgr.exe'
        - '\wwahost.exe'
    Protocol: tcp
    Initiated: 'true'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.command-and-control
• attack.t1573
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1573

References

• https://www.virustotal.com/gui/file/d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44
• https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
• https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/Pikabot/net_connection_win_malware_pikabot_rundll32_activity.yml