Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries

Alerts when rundll32.exe spawns specific Windows binaries in patterns consistent with potential process hollowing.

FreeReviewedSigma · High · v5

Product: windows
Category: process_creation
Author: Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
Published: 2023-10-27
Updated: 2026-07-31

ATT&CK techniques

Priv Esc → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1055.012Process Hollowing
Defense Evasion
- T1055.012Process Hollowing
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions where rundll32.exe spawns specific legitimate Windows binaries associated with process hollowing behavior. An attacker can use this technique to start benign processes while replacing their contents to evade detection and complicate analysis. It relies on process creation telemetry capturing parent Image and command line, along with child process Image paths. The rule also filters a known benign case involving rundll32 launching sndvol.exe via the mmsys.cpl context.

Reporting behind it

Related detections9 linkedT1055.012 — drag to rearrange

Suspicious MSBuild Spawned by PowerShell (via process_creation)

Suspicious RegSvcs Execution Spawned by Script Interpreter for Process Hollowing (via process_creation)

Suspicious MSBuild Execution Spawned by PowerShell via PhantomVAI Loader (via process_creation)

Suspicious Rundll32 Loading Non-DLL Image Extension File

Suspicious MSBuild Execution Spawned by Command Shell for Process Hollowing (via process_creation)

Malicious Desktop Window Manager Impersonation From Non-System Path via process_creation

Suspicious .NET Utility Spawned by AutoHotkey Loader for Process Hollowing (via process_creation)

Suspicious csc.exe Spawned by Document Reader for Process Injection

Suspicious RegAsm Execution Spawned by Script Host for Process Hollowing (via process_creation)

Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries

Pivot detection · T1055.012 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-rundll32-parent-with-select-binary-execution-indicative-of-process-hollo-d8937fe7

title: "Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries"
id: f9367be4-f9b4-4bc1-8525-dc2a2478a92f
status: test
description: This rule flags process executions where rundll32.exe spawns specific legitimate Windows binaries associated with process hollowing behavior. An attacker can use this technique to start benign processes while replacing their contents to evade detection and complicate analysis. It relies on process creation telemetry capturing parent Image and command line, along with child process Image paths. The rule also filters a known benign case involving rundll32 launching sndvol.exe via the mmsys.cpl context.
references:
  - https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
  - https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
  - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055.012
  - detection.emerging-threats
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    ParentImage|endswith: \rundll32.exe
    Image|endswith:
      - \SearchFilterHost.exe
      - \SearchProtocolHost.exe
      - \sndvol.exe
      - \wermgr.exe
      - \wwahost.exe
  filter_main_legit_sndvol:
    Image|endswith: \sndvol.exe
    ParentCommandLine|contains: mmsys.cpl
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d8937fe7-42d5-4b4d-8178-e089c908f63f
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL