Potential Pikabot Discovery Activity
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Detection logic
selection_parent
- GrandParentImage|endswith: \rundll32.exe
- ParentImage|endswith:
- \SearchFilterHost.exe
- \SearchProtocolHost.exeselection_child
CommandLine:
- ipconfig.exe /all
- netstat.exe -aon
- whoami.exe /allCondition
all of selection_*Raw YAML
title: Potential Pikabot Discovery Activity
id: 698d4431-514f-4c82-af4d-cf573872a9f5
status: test
description: |
Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
references:
- https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
- https://tria.ge/231023-lpw85she57/behavioral2
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
- attack.discovery
- attack.t1016
- attack.t1049
- attack.t1087
- detection.emerging-threats
logsource:
product: windows
category: process_creation
definition: 'Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule'
detection:
selection_parent:
- GrandParentImage|endswith: '\rundll32.exe'
- ParentImage|endswith:
- '\SearchFilterHost.exe'
- '\SearchProtocolHost.exe'
selection_child:
CommandLine:
# Note: Only add strings as seen used by Pikabot to avoid collision with other strains of malware
- 'ipconfig.exe /all'
- 'netstat.exe -aon'
- 'whoami.exe /all'
condition: all of selection_*
falsepositives:
- Unlikely
level: highFalse positives
- Unlikely