Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
Published: 2023-10-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies short-lived system discovery commands executed from processes that originate from rundll32.exe and related search host binaries. It matches command lines for enumerating network configuration (ipconfig), active connections and listeners (netstat -aon), and local identity details (whoami /all). The behavior matters because such discovery data is commonly collected quickly to support botnet registration or follow-on access, and this detection relies on process creation telemetry with parent/GrandParentImage and CommandLine fields.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Cisco AAA discovery via show/dir commands

Suspicious ROADtools User Agent Against Microsoft Graph (via azure)

Suspicious External Address Reconnaissance via curl to ifconfig me via process_creation

Malicious Recon Output Staged in Qlik Sense Fonts Directory by Cactus Ransomware

Suspicious Bazar Network Reconnaissance Command Batch

Suspicious Domain Trust Discovery via Nltest

Possible Local Group Membership Enumeration via Security Event 4798

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Windows Process Creation Signals for Pikabot System Discovery

Pivot detection · T1016 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-discovery-commands-triggered-via-rundll32-and-search-host-parent-698d4431

title: Windows Process Creation Signals for Pikabot System Discovery
id: d90e488a-0639-4413-a104-9737d40eae9c
status: test
description: This rule identifies short-lived system discovery commands executed from processes that originate from rundll32.exe and related search host binaries. It matches command lines for enumerating network configuration (ipconfig), active connections and listeners (netstat -aon), and local identity details (whoami /all). The behavior matters because such discovery data is commonly collected quickly to support botnet registration or follow-on access, and this detection relies on process creation telemetry with parent/GrandParentImage and CommandLine fields.
references:
  - https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
  - https://tria.ge/231023-lpw85she57/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1049
  - attack.t1087
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
  definition: "Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule"
detection:
  selection_parent:
    - GrandParentImage|endswith: \rundll32.exe
    - ParentImage|endswith:
        - \SearchFilterHost.exe
        - \SearchProtocolHost.exe
  selection_child:
    CommandLine:
      - ipconfig.exe /all
      - netstat.exe -aon
      - whoami.exe /all
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 698d4431-514f-4c82-af4d-cf573872a9f5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL