Detection rules › Sigma
Potential Pikabot Hollowing Activity
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | T1055.012 Process Injection: Process Hollowing |
| Stealth | T1055.012 Process Injection: Process Hollowing |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
title: Potential Pikabot Hollowing Activity
id: d8937fe7-42d5-4b4d-8178-e089c908f63f
status: test
description: |
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
references:
- https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
- https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.012
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: '\rundll32.exe'
Image|endswith:
# Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
- '\SearchFilterHost.exe'
- '\SearchProtocolHost.exe'
- '\sndvol.exe'
- '\wermgr.exe'
- '\wwahost.exe'
filter_main_legit_sndvol:
Image|endswith: '\sndvol.exe'
ParentCommandLine|contains: 'mmsys.cpl'
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
Stages and Predicates
Stage 0: condition
selection and not 1 of filter_main_*Stage 1: selection
selection:
ParentImage|endswith: '\rundll32.exe'
Image|endswith:
- '\SearchFilterHost.exe'
- '\SearchProtocolHost.exe'
- '\sndvol.exe'
- '\wermgr.exe'
- '\wwahost.exe'
Stage 2: not filter_main_legit_sndvol
filter_main_legit_sndvol:
Image|endswith: '\sndvol.exe'
ParentCommandLine|contains: 'mmsys.cpl'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
Image | ends_with | \sndvol.exe |
ParentCommandLine | match | mmsys.cpl |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Image | ends_with |
|
ParentImage | ends_with |
|