Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
Published: 2023-10-27
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies short-lived system discovery commands executed from processes that originate from rundll32.exe and related search host binaries. It matches command lines for enumerating network configuration (ipconfig), active connections and listeners (netstat -aon), and local identity details (whoami /all). The behavior matters because such discovery data is commonly collected quickly to support botnet registration or follow-on access, and this detection relies on process creation telemetry with parent/GrandParentImage and CommandLine fields.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Reconnaissance Spawned by Injected SearchProtocolHost via process_creation

Cisco AAA discovery via show/dir commands

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Windows Process Creation Signals for Pikabot System Discovery

Pivot detection · T1016 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-discovery-commands-triggered-via-rundll32-and-search-host-parent-698d4431

title: Windows Process Creation Signals for Pikabot System Discovery
id: d90e488a-0639-4413-a104-9737d40eae9c
status: test
description: This rule identifies short-lived system discovery commands executed from processes that originate from rundll32.exe and related search host binaries. It matches command lines for enumerating network configuration (ipconfig), active connections and listeners (netstat -aon), and local identity details (whoami /all). The behavior matters because such discovery data is commonly collected quickly to support botnet registration or follow-on access, and this detection relies on process creation telemetry with parent/GrandParentImage and CommandLine fields.
references:
  - https://www.virustotal.com/gui/file/72f1a5476a845ea02344c9b7edecfe399f64b52409229edaf856fcb9535e3242
  - https://tria.ge/231023-lpw85she57/behavioral2
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_discovery.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
  - attack.discovery
  - attack.t1016
  - attack.t1049
  - attack.t1087
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
  definition: "Requirements: By default the process_creation type event might not contain the GrandParentImage. Make sure you collect such fields in order to use this rule"
detection:
  selection_parent:
    - GrandParentImage|endswith: \rundll32.exe
    - ParentImage|endswith:
        - \SearchFilterHost.exe
        - \SearchProtocolHost.exe
  selection_child:
    CommandLine:
      - ipconfig.exe /all
      - netstat.exe -aon
      - whoami.exe /all
  condition: all of selection_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 698d4431-514f-4c82-af4d-cf573872a9f5
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL