CikaBika Bot: Rust RAT Abusing Discord for C2 — Detection and Response Guide for Windows Defenders

---
title: Suspicious Non-Discord Process Connecting to Discord Infrastructure
id: 3f8a1b24-6c7d-4e91-a2b3-cikabika0001
status: experimental
description: Detects processes other than the legitimate Discord client or browsers establishing network connections to Discord domains, consistent with malware abusing Discord for C2 (e.g., CikaBika Bot).
references:
  - https://securityaffairs.com/201210/security/rust-based-cikabika-bot-turns-discord-into-a-command-center.html
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1102.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_domains:
    DestinationHostname|contains:
      - 'discord.com'
      - 'discordapp.com'
      - 'discord.gg'
      - 'discord.media'
  filter_legit:
    Image|endswith:
      - '\Discord\app-1.0.\Update.exe'
      - '\Discord.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
  filter_discord_client_path:
    Image|contains: '\AppData\Local\Discord\'
  condition: selection_domains and not 1 of filter_*
falsepositives:
  - Legitimate third-party Discord integrations or developer tooling (rare on standard user endpoints)
  - Embedded web views in applications
level: high
---
title: Ngrok Tunnel Execution on Endpoint
id: 7c2d9e41-5a6b-48f3-b1c4-cikabika0002
status: experimental
description: Detects execution of the Ngrok tunneling binary or Ngrok-style command-line arguments, which CikaBika Bot uses to enable remote interactive access to compromised hosts.
references:
  - https://securityaffairs.com/201210/security/rust-based-cikabika-bot-turns-discord-into-a-command-center.html
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.command_and_control
  - attack.t1572
  - attack.t1102
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: '\ngrok.exe'
    - OriginalFileName: 'ngrok.exe'
  selection_cli:
    CommandLine|contains:
      - 'ngrok tcp'
      - 'ngrok http'
      - 'ngrok start'
      - '.ngrok.io'
      - '.ngrok-free.app'
      - 'ngrok-agent'
  condition: 1 of selection_*
falsepositives:
  - Developer workstations legitimately using Ngrok for tunneling — scope exclusions by developer OU/hostname rather than globally
level: high
---
title: Execution From Mounted Disk Image (ISO/IMG Lure)
id: 9e4f6b83-2d1c-47a5-93e8-cikabika0003
status: experimental
description: Detects process execution from a mounted disk image volume, consistent with ISO/IMG lure chains observed delivering CikaBika Bot via fake documents.
references:
  - https://securityaffairs.com/201210/security/rust-based-cikabika-bot-turns-discord-into-a-command-center.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1204.002
  - attack.initial_access
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|startswith:
      - 'D:\\'
      - 'E:\\'
      - 'F:\\'
      - 'G:\\'
      - '\\Device\\CdRom'
  filter_parent_explorer_not:
    ParentImage|endswith: '\explorer.exe'
  condition: selection and not filter_parent_explorer_not
falsepositives:
  - Legitimate software installation from mounted ISOs in IT/admin contexts — tune drive letters to your environment and alert only on non-admin users if needed
level: medium

// Hunt 1: Non-browser processes connecting to Discord infrastructure (C2 over SaaS)
let DiscordDomains = dynamic(["discord.com", "discordapp.com", "cdn.discordapp.com", "discord.gg", "discord.media"]);
let LegitDiscordProcs = dynamic(["Discord.exe", "Update.exe", "chrome.exe", "msedge.exe", "firefox.exe", "brave.exe", "opera.exe"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any (DiscordDomains)
| where not(InitiatingProcessFileName in~ (LegitDiscordProcs))
| where not(InitiatingProcessFolderPath has @"AppData\Local\Discord")
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
    RemoteIPs=make_set(RemoteIP), RemoteUrls=make_set(RemoteUrl)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, InitiatingProcessCommandLine
| order by FirstSeen asc;

// Hunt 2: Ngrok execution or tunnel endpoints across the fleet
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName =~ "ngrok.exe"
   or ProcessCommandLine has_any ("ngrok tcp", "ngrok http", "ngrok start", "ngrok-free.app", ".ngrok.io", "ngrok-agent")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessAccountName, SHA256, InitiatingProcessCommandLine
| order by TimeGenerated desc;

// Hunt 3: Correlate — hosts showing BOTH Discord C2-like traffic AND Ngrok activity (high confidence)
let DiscordHosts =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any ("discord.com", "discordapp.com")
    | where not(InitiatingProcessFolderPath has @"AppData\Local\Discord")
    | where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe"))
    | summarize by DeviceName;
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemoteUrl has_any ("ngrok.io", "ngrok-free.app") or InitiatingProcessFileName =~ "ngrok.exe"
| where DeviceName in (DiscordHosts)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| order by TimeGenerated desc;

-- Hunt for CikaBika Bot indicators: Ngrok execution, Discord API connections
-- from non-Discord processes, and recently mounted ISO artifacts

-- Part 1: Processes with ngrok or discord-related command lines
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)ngrok|discord(app)?\.(com|gg)|discord\.com/api'
  AND Exe !~ '(?i)AppData\\Local\\Discord'

-- Part 2: Live network connections to Discord/Ngrok infrastructure
SELECT Pid, Name, Path, Status, RemoteAddr, RemotePort
FROM netstat()
WHERE RemoteAddr =~ 'discord|ngrok'
  AND Path !~ '(?i)AppData\\Local\\Discord|chrome|msedge|firefox'

-- Part 3: Recently downloaded/mounted disk images in user directories
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\\Users\\*\\Downloads\\*.iso')
WHERE Mtime > now() - 604800

# CikaBika Bot response and hardening script - run elevated, review before execution
# Step 1: Inventory - find non-Discord processes with Discord/Ngrok connections
Write-Host "=== Inventory: suspicious processes talking to Discord/Ngrok ===" -ForegroundColor Cyan
$suspectConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in 443, 80 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.Name -notin @('Discord','chrome','msedge','firefox','brave','opera','svchost','teams','slack')) {
            try {
                $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
            } catch { $rdns = 'unresolved' }
            if ($rdns -match 'discord|ngrok') {
                [PSCustomObject]@{
                    PID = $_.OwningProcess
                    Process = $proc.Name
                    Path = $proc.Path
                    RemoteIP = $_.RemoteAddress
                    RemoteHost = $rdns
                }
            }
        }
    }
$suspectConns | Format-Table -AutoSize

# Step 2: Kill ngrok processes and quarantine the binary
Write-Host "=== Terminating ngrok processes ===" -ForegroundColor Yellow
Get-Process -Name 'ngrok' -ErrorAction SilentlyContinue | ForEach-Object {
    Write-Host "Killing ngrok PID $($_.Id) at $($_.Path)"
    $_.Path | Out-File -Append "$env:TEMP\cikabika_quarantine_paths.txt"
    Stop-Process -Id $_.Id -Force
}

# Step 3: Block Ngrok domains at Windows Firewall (defense-in-depth; DNS filter preferred)
Write-Host "=== Adding firewall blocks for ngrok endpoints ===" -ForegroundColor Yellow
New-NetFirewallRule -DisplayName 'Block Ngrok Outbound (CikaBika IR)' -Direction Outbound `
    -Action Block -RemoteAddress (Resolve-DnsName 'ngrok.io' -Type A -ErrorAction SilentlyContinue | ForEach-Object IPAddress) `
    -ErrorAction SilentlyContinue | Out-Null

# Step 4: Check for persistence - Run keys and scheduled tasks referencing suspect paths
Write-Host "=== Persistence audit ===" -ForegroundColor Cyan
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run' -ErrorAction SilentlyContinue |
    Out-File "$env:TEMP\cikabika_runkeys.txt"
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'ngrok|Temp\\|AppData\\Local\\Temp'
} | Format-Table TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}} -AutoSize

# Step 5: Collect mounted ISO evidence (do not dismount before imaging if IR is ongoing)
Write-Host "=== Mounted disk images ===" -ForegroundColor Cyan
Get-DiskImage -ErrorAction SilentlyContinue | Where-Object Attached |
    Select-Object ImagePath, DevicePath | Format-Table -AutoSize

Write-Host "DONE. Evidence logged to $env:TEMP\cikabika_*.txt - preserve before remediation." -ForegroundColor Green