Pingback Backdoor Process Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•27

Detects the use of the Pingback backdoor, which establishes an ICMP tunnel for command and control (C2) communications. The rule specifically looks for the creation of a process where the parent image ends with 'updata.exe' and the command line contains 'config', 'msdtc', 'start', and 'auto'. This combination of parent process and command-line arguments is indicative of the Pingback backdoor's activity as described in the Trustwave report.