Rule Info
Name
Potential Pikabot C2 Activity - Suspicious Process Created By Rundll32.EXE
Author
Andreas Braathen (mnemonic.io)
Description
Detects the execution of rundll32 that leads to an external network connection.
The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.
Reference
Date
2023-10-27 00:00:00
Modified
None
Id
cae6cee6-0244-44d2-84ed-e65f548eb7dc
Tags
attack.command_and_control attack.t1573 detection.emerging_threats DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Andreas Braathen
Merge PR #4521 from @netgrain - Add New Rules Related To Pikabot
2023-11-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR