Malware: Pikabot delivery via URL auto-download

 1name: "Malware: Pikabot delivery via URL auto-download"
 2description: "This rule detects URLs matching a known Pikabot pattern where the linked domain has been reported to URLhaus, or the link downloads an archive containing a JS file, or a file in the archive hash is found in Malware Bazaar."
 3type: "rule"
 4severity: "high"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          regex.imatch(.display_url.url, '.+\/[a-z0-9]+\/\?[0-9a-z]+')
 9  )
10  and (
11    any(body.links,
12        .href_url.domain.domain in $abuse_ch_urlhaus_domains_trusted_reporters
13        and not .href_url.domain.domain in ("drive.google.com", "github.com")
14    )
15    or any(body.links,
16           any(ml.link_analysis(., mode="aggressive").files_downloaded,
17               .file_extension in~ $file_extensions_common_archives
18               and (
19                 any(file.explode(.),
20                     .file_extension =~ "js"
21                     or .scan.hash.sha256 in $abuse_ch_malwarebazaar_sha256_trusted_reporters
22                 )
23               )
24           )
25    )
26  )
27  
28  // negate highly trusted sender domains unless they fail DMARC authentication
29  and not (
30    sender.email.domain.root_domain in $high_trust_sender_root_domains
31    and coalesce(headers.auth_summary.dmarc.pass, false)
32  )
33  and (
34    not profile.by_sender().solicited
35    or profile.by_sender().any_messages_malicious_or_spam
36  )  
37tags:
38  - "Malfam: Pikabot"
39attack_types:
40  - "Malware/Ransomware"
41tactics_and_techniques:
42  - "Evasion"
43detection_methods:
44  - "Archive analysis"
45  - "File analysis"
46  - "Threat intelligence"
47  - "URL analysis"
48id: "f4be4572-82dc-5229-81ad-bd9fc9d6b673"