Rule Info
Name
Potential Pikabot Discovery Activity - Suspicious Process Created By Rundll32.EXE
Author
Andreas Braathen (mnemonic.io)
Description
Detects the execution of rundll32 that leads to system discovery activity, such as incl. network, user info and domain groups.
The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).
Reference
Date
2023-10-27 00:00:00
Modified
None
Id
698d4431-514f-4c82-af4d-cf573872a9f5
Tags
attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging_threats DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Andreas Braathen
Merge PR #4521 from @netgrain - Add New Rules Related To Pikabot
2023-11-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR