Qakbot Rundll32 Exports Execution
This rule detects the execution of 'rundll32.exe' with specific command-line arguments and parent processes that are characteristic of Qakbot malware activity. It looks for 'rundll32.exe' being launched by common scripting or command-line interpreters (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and attempting to load DLLs from suspicious paths (ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming). Additionally, it specifically targets known export functions used by Qakbot, such as 'aslr', 'bind', 'DrawThemeIcon', 'GG10', 'GL70', 'jhbvygftr', 'kjhbhkjvydrt', 'LS88', 'Motd', 'N115', 'next', 'Nikn', 'print', 'qqqb', 'qqqq', 'RS32', 'Test', 'Time', 'Updt', 'vips', 'Wind', 'WW50', 'X555', 'XL55', 'xlAutoOpen', and 'XS88'. This combination of indicators aims to reduce false positives by focusing on behaviors uniquely associated with Qakbot.
Sigma
