Sigma rule: Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Rule

Title

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Status

test

Level

medium

Author

Alejandro Houspanossian ('@lekz86')

Date

2024-01-02

File

rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads.
Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files.
In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Log source

product

windows

category

process_creation

Detection

selection_cmd:
    CommandLine|contains|all:
        - 'cmd'
        - '/c'
selection_pipes:
    CommandLine|contains:
        - ' & '
        - ' || '
selection_commands_1:
    CommandLine|contains:
        - ' curl'
        - ' wget'
        - ' timeout '
        - ' ping '
selection_commands_2:
    CommandLine|contains:
        - ' rundll32'
        - ' mkdir '
condition: all of selection_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.command-and-control
• attack.execution
• attack.stealth
• attack.t1059.003
• attack.t1105
• attack.t1218
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1059.003
• T1105
• T1218

References

• https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_30.10.2023.txt
• https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_22.12.2023.txt

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml