Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries
Alerts when rundll32.exe spawns specific Windows binaries in patterns consistent with potential process hollowing.
- Product
- windows
- Category
- process_creation
- Author
- Andreas Braathen (mnemonic.io) (SigmaHQ), DRL 1.1
- Published
- 2023-10-27
- Updated
- 2026-07-31
ATT&CK techniques
Priv Esc → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions where rundll32.exe spawns specific legitimate Windows binaries associated with process hollowing behavior. An attacker can use this technique to start benign processes while replacing their contents to evade detection and complicate analysis. It relies on process creation telemetry capturing parent Image and command line, along with child process Image paths. The rule also filters a known benign case involving rundll32 launching sndvol.exe via the mmsys.cpl context.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
- virustotal.comhttps://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
- github.comhttps://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: rundll32 Spawns Pikabot-Like Hollowing Binaries"
id: f9367be4-f9b4-4bc1-8525-dc2a2478a92f
status: test
description: This rule flags process executions where rundll32.exe spawns specific legitimate Windows binaries associated with process hollowing behavior. An attacker can use this technique to start benign processes while replacing their contents to evade detection and complicate analysis. It relies on process creation telemetry capturing parent Image and command line, along with child process Image paths. The rule also filters a known benign case involving rundll32 launching sndvol.exe via the mmsys.cpl context.
references:
- https://www.virustotal.com/gui/file/b6e8910fb9b3bb1fcddefd35ff0ed8624930d30d6977e11808c8330415685a62
- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
- https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_06.12.2023.txt
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_rundll32_hollowing.yml
author: Andreas Braathen (mnemonic.io), Huntrule Team
date: 2023-10-27
modified: 2024-01-26
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1055.012
- detection.emerging-threats
logsource:
product: windows
category: process_creation
detection:
selection:
ParentImage|endswith: \rundll32.exe
Image|endswith:
- \SearchFilterHost.exe
- \SearchProtocolHost.exe
- \sndvol.exe
- \wermgr.exe
- \wwahost.exe
filter_main_legit_sndvol:
Image|endswith: \sndvol.exe
ParentCommandLine|contains: mmsys.cpl
condition: selection and not 1 of filter_main_*
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: d8937fe7-42d5-4b4d-8178-e089c908f63f
type: derived