Rule Info
Name
Potential Pikabot Hollowing Activity - Suspicious Process Created By Rundll32.EXE
Author
Andreas Braathen (mnemonic.io)
Description
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
Reference
Date
2023-10-27 00:00:00
Modified
None
Id
d8937fe7-42d5-4b4d-8178-e089c908f63f
Tags
attack.defense_evasion attack.t1055.012 detection.emerging_threats DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Andreas Braathen
Merge PR #4521 from @netgrain - Add New Rules Related To Pikabot
2023-11-06
Scan your endpoints, forensic images or collected files with our portable scanner THOR