detection.wiki

Detection rules › Sigma

Potential Pikabot Discovery Activity

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Andreas Braathen (mnemonic.io)
Source
github.com/SigmaHQ/sigma

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).

MITRE ATT&CK coverage

TacticTechniques
DiscoveryT1016 System Network Configuration Discovery, T1049 System Network Connections Discovery, T1087 Account Discovery

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential Pikabot Discovery Activity
id: 698d4431-514f-4c82-af4d-cf573872a9f5
status: test
description: |
    Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups.
    The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
references:
    - https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
    - https://tria.ge/231023-lpw85she57/behavioral2
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
    - attack.discovery
    - attack.t1016
    - attack.t1049
    - attack.t1087
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
    definition: 'Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule'
detection:
    selection_parent:
        - GrandParentImage|endswith: '\rundll32.exe'
        - ParentImage|endswith:
              - '\SearchFilterHost.exe'
              - '\SearchProtocolHost.exe'
    selection_child:
        CommandLine:
            # Note: Only add strings as seen used by Pikabot to avoid collision with other strains of malware
            - 'ipconfig.exe /all'
            - 'netstat.exe -aon'
            - 'whoami.exe /all'
    condition: all of selection_*
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_parent

selection_parent:
    - GrandParentImage|endswith: '\rundll32.exe'
    - ParentImage|endswith:
          - '\SearchFilterHost.exe'
          - '\SearchProtocolHost.exe'

Stage 2: selection_child

selection_child:
    CommandLine:
        - 'ipconfig.exe /all'
        - 'netstat.exe -aon'
        - 'whoami.exe /all'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLineeq
  • ipconfig.exe /all
  • netstat.exe -aon
  • whoami.exe /all
GrandParentImageends_with
  • \rundll32.exe
ParentImageends_with
  • \SearchFilterHost.exe
  • \SearchProtocolHost.exe corpus 2 (sigma 2)