Pikabot

Pikabot Fake DLL Extension Execution Via Rundll32.EXE

Apr 28, 2026 · attack.execution detection.emerging-threats attack.stealth ·

Detects specific process tree behavior linked to "rundll32" executions, wherein the associated DLL lacks a common ".dll" extension, often signaling potential Pikabot activity.

Potential Pikabot Hollowing Activity

Apr 28, 2026 · attack.privilege-escalation attack.stealth attack.t1055.012 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE

Apr 28, 2026 · attack.command-and-control attack.execution attack.stealth attack.t1059.003 attack.t1105 attack.t1218 detection.emerging-threats ·

Share on:

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

Potential Pikabot C2 Activity

Dec 1, 2024 · attack.command-and-control attack.t1573 detection.emerging-threats ·

Share on:

Detects the execution of rundll32 that leads to an external network connection. The malware Pikabot has been seen to use this technique to initiate C2-communication through hard-coded Windows binaries.

Potential Pikabot Discovery Activity

Dec 1, 2024 · attack.discovery attack.t1016 attack.t1049 attack.t1087 detection.emerging-threats ·

Share on:

Detects system discovery activity carried out by Pikabot, such as incl. network, user info and domain groups. The malware Pikabot has been seen to use this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute).