Potential Pikabot Hollowing Activity

testhigh
Log-Quelle: windows · process_creationAutor Andreas Braathen (mnemonic.io)Datum 2023-10-27
01

Beschreibung

Was dies ist, in Kürze.

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

02

Tags

attack.privilege-escalationattack.stealthattack.t1055.012detection.emerging-threats
03

Regelquelle (YAML)

title: Potential Pikabot Hollowing Activity
id: d8937fe7-42d5-4b4d-8178-e089c908f63f
status: test
description: |
    Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries.
    The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries
references:
    - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
    - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
    - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
    - attack.privilege-escalation
    - attack.stealth
    - attack.t1055.012
    - detection.emerging-threats
logsource:
    product: windows
    category: process_creation
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith:
            # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
            - '\SearchFilterHost.exe'
            - '\SearchProtocolHost.exe'
            - '\sndvol.exe'
            - '\wermgr.exe'
            - '\wwahost.exe'
    filter_main_legit_sndvol:
        Image|endswith: '\sndvol.exe'
        ParentCommandLine|contains: 'mmsys.cpl'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unlikely
level: high
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.