detection.wiki

Detection rules › Sigma

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4688A new process has been created.

Rule body yaml

title: Pikabot Fake DLL Extension Execution Via Rundll32.EXE
id: 1bf0ba65-9a39-42a2-9271-31d31bf2f0bf
status: test
description: |
    Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.
references:
    - https://github.com/pr0xylife/Pikabot
    - https://tria.ge/231004-tp8k6sch9t/behavioral2
    - https://www.virustotal.com/gui/file/56db0c4842a63234ab7fe2dda6eeb63aa7bb68f9a456985b519122f74dea37e2/behavior
    - https://tria.ge/231212-r1bpgaefar/behavioral2
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2024-01-26
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith:
            - '\cmd.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\regsvr32.exe'
            - '\wscript.exe'
        Image|endswith: '\rundll32.exe'
        CommandLine|contains:
            - ':\ProgramData\'
            - ':\Users\Public\'
            - ':\Windows\Installer\'
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
    filter_main_known_extension:
        - CommandLine|contains:
              - '.cpl '
              - '.cpl,'
              - '.dll '
              - '.dll,'
              - '.inf '
              - '.inf,'
        - CommandLine|endswith:
              - '.cpl'
              - '.cpl"'
              - '.dll'
              - '.dll"'
              - '.inf'
              - '.inf"'
              - ".cpl'"
              - ".dll'"
              - ".inf'"
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    ParentImage|endswith:
        - '\cmd.exe'
        - '\cscript.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\regsvr32.exe'
        - '\wscript.exe'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        - ':\ProgramData\'
        - ':\Users\Public\'
        - ':\Windows\Installer\'
        - '\AppData\Local\Temp\'
        - '\AppData\Roaming\'

Stage 2: not filter_main_known_extension

filter_main_known_extension:
    - CommandLine|contains:
          - '.cpl '
          - '.cpl,'
          - '.dll '
          - '.dll,'
          - '.inf '
          - '.inf,'
    - CommandLine|endswith:
          - '.cpl'
          - '.cpl"'
          - '.dll'
          - '.dll"'
          - '.inf'
          - '.inf"'
          - ".cpl'"
          - ".dll'"
          - ".inf'"

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
CommandLineends_with.cpl
CommandLineends_with.cpl'
CommandLineends_with.cpl"
CommandLineends_with.dll
CommandLineends_with.dll'
CommandLineends_with.dll"
CommandLineends_with.inf
CommandLineends_with.inf'
CommandLineends_with.inf"
CommandLinematch.cpl
CommandLinematch.cpl,
CommandLinematch.dll
CommandLinematch.dll,
CommandLinematch.inf
CommandLinematch.inf,

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • :\ProgramData\ corpus 9 (sigma 9)
  • :\Users\Public\ corpus 18 (sigma 18)
  • :\Windows\Installer\
  • \AppData\Local\Temp\ corpus 26 (sigma 26)
  • \AppData\Roaming\ corpus 16 (sigma 16)
Imageends_with
  • \rundll32.exe corpus 95 (sigma 95)
ParentImageends_with
  • \cmd.exe corpus 20 (sigma 20)
  • \cscript.exe corpus 17 (sigma 17)
  • \mshta.exe corpus 13 (sigma 13)
  • \powershell.exe corpus 24 (sigma 24)
  • \pwsh.exe corpus 21 (sigma 21)
  • \regsvr32.exe corpus 11 (sigma 11)
  • \wscript.exe corpus 19 (sigma 19)