Potential Pikabot C2 Activity

testhigh
log source: windows · network_connectionauthor Andreas Braathen (mnemonic.io)date 2023-10-27
01

description

What this is, in brief.

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

02

tags

attack.command-and-controlattack.t1573detection.emerging-threats
03

rule source (YAML)

title: Potential Pikabot C2 Activity
id: cae6cee6-0244-44d2-84ed-e65f548eb7dc
status: test
description: |
    Detects the execution of rundll32 that leads to an external network connection.
    The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.
references:
    - https://www.virustotal.com/gui/file/d72af640b71b8e3eca3eba660dd7c7f029ff8852bcacaa379e7b6c57cf4d9b44
    - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
    - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
author: Andreas Braathen (mnemonic.io)
date: 2023-10-27
modified: 2024-01-26
tags:
    - attack.command-and-control
    - attack.t1573
    - detection.emerging-threats
logsource:
    product: windows
    category: network_connection
    definition: 'Requirements: By default the network_connection type event might not contain the ParentImage. Make sure you collect such fields in order to use this rule'
detection:
    selection:
        ParentImage|endswith: '\rundll32.exe'
        Image|endswith:
            # Note: Only add processes seen used by Pikabot to avoid collision with other strains of malware
            - '\SearchFilterHost.exe'
            - '\SearchProtocolHost.exe'
            - '\sndvol.exe'
            - '\wermgr.exe'
            - '\wwahost.exe'
        Protocol: tcp
        Initiated: 'true'
    condition: selection
falsepositives:
    - Unlikely
level: high
04

detects techniques (1)

ATT&CK techniques this enables or maps to.

05

references

External citations — patches, advisories, analysis.