Windows Cmd.exe Suspicious Command Chains Indicative of Pikabot-Style Execution

title: Windows Cmd.exe Suspicious Command Chains Indicative of Pikabot-Style Execution
id: 5e53c646-8ce6-4af2-b078-40cba2bbc484
status: test
description: This rule flags Windows process executions where cmd.exe runs with /c and includes chained commands using delimiters like ' & ' or ' || '. It further matches command lines that contain typical payload-delivery and orchestration components such as curl/wget, ping/timeout delays, and rundll32 usage. This behavior matters because attackers commonly use command chaining to download, delay, and execute additional malicious components through a single cmd.exe invocation. The detection relies on process creation telemetry, specifically the full CommandLine content.
references:
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_30.10.2023.txt
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_22.12.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml
author: Alejandro Houspanossian ('@lekz86'), Huntrule Team
date: 2024-01-02
tags:
  - attack.command-and-control
  - attack.execution
  - attack.stealth
  - attack.t1059.003
  - attack.t1105
  - attack.t1218
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection_cmd:
    CommandLine|contains|all:
      - cmd
      - /c
  selection_pipes:
    CommandLine|contains:
      - " & "
      - " || "
  selection_commands_1:
    CommandLine|contains:
      - " curl"
      - " wget"
      - " timeout "
      - " ping "
  selection_commands_2:
    CommandLine|contains:
      - " rundll32"
      - " mkdir "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e5144106-8198-4f6e-bfc2-0a551cc8dd94
    type: derived