rules/windows/process_creation/proc_creation_win_malware_qbot.yml

title: Potential QBot Activity
id: 4fcac6eb-0287-4090-8eea-2602e4c20040
status: stable
description: Detects potential QBot activity by looking for process executions used previously by QBot
references:
    - https://twitter.com/killamjr/status/1179034907932315648
    - https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/
author: Florian Roth (Nextron Systems)
date: 2019/10/01
modified: 2023/02/03
tags:
    - attack.execution
    - attack.t1059.005
logsource:
    category: process_creation
    product: windows
detection:
    selection1:
        ParentImage|endswith: '\WinRAR.exe'
        Image|endswith: '\wscript.exe'
    selection2:
        CommandLine|contains: ' /c ping.exe -n 6 127.0.0.1 & type '
    selection3:
        CommandLine|contains|all:
            - 'regsvr32.exe'
            - 'C:\ProgramData'
            - '.tmp'
    condition: 1 of selection*
fields:
    - CommandLine
    - ParentCommandLine
falsepositives:
    - Unlikely
level: critical
feat: multiple updates and fixes 2023-02-03 02:22:28 +01:00			`title: Potential QBot Activity`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 4fcac6eb-0287-4090-8eea-2602e4c20040`
chore: promote status of rules 2022-03-31 12:03:27 +02:00			`status: stable`
feat: multiple updates and fixes 2023-02-03 02:22:28 +01:00			`description: Detects potential QBot activity by looking for process executions used previously by QBot`
$frack113$ order yaml 2022-10-28 15:06:36 +02:00			`references:`
			`- https://twitter.com/killamjr/status/1179034907932315648`
			`- https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/`
chore: add nextron authors tag 2023-02-01 11:14:59 +01:00			`author: Florian Roth (Nextron Systems)`
rule: QBot process creation 2019-10-01 17:25:04 +02:00			`date: 2019/10/01`
feat: multiple updates and fixes 2023-02-03 02:22:28 +01:00			`modified: 2023/02/03`
att&ck tags review: windows/process_creation part 3 2020-09-01 17:02:36 +00:00			`tags:`
			`- attack.execution`
			`- attack.t1059.005`
rule: QBot process creation 2019-10-01 17:25:04 +02:00			`logsource:`
			`category: process_creation`
			`product: windows`
			`detection:`
			`selection1:`
Update win_malware_qbot.yml 2020-10-15 18:02:35 -03:00			`ParentImage\|endswith: '\WinRAR.exe'`
			`Image\|endswith: '\wscript.exe'`
rule: QBot process creation 2019-10-01 17:25:04 +02:00			`selection2:`
Update win_malware_qbot.yml 2020-10-15 18:02:35 -03:00			`CommandLine\|contains: ' /c ping.exe -n 6 127.0.0.1 & type '`
rule: new Quakbot pattern 2021-01-25 12:03:30 +01:00			`selection3:`
			`CommandLine\|contains\|all:`
			`- 'regsvr32.exe'`
			`- 'C:\ProgramData'`
			`- '.tmp'`
Add '/k' option to CMD rules 2022-08-24 12:48:23 +01:00			`condition: 1 of selection*`
rule: QBot process creation 2019-10-01 17:25:04 +02:00			`fields:`
			`- CommandLine`
			`- ParentCommandLine`
			`falsepositives:`
			`- Unlikely`
			`level: critical`