Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
36
16
14
7
1
Contributors
36
14
13
9
1
Categories
32
26
10
9
8
Platforms
64
8
1
Products / Services
34
27
24
13
8
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
IDS Classtypes
4
3
IDS Protocols
5
2
The analytic detects the execution of Regsvr32.exe with the silent switch (`-s` or `/s`) to load DLLs. This behavior is commonly used in malware campaigns, such as IcedID, to stealthily load malicious DLLs, allowing attackers to execute arbitrary code, download additional payloads, and potentially compromise the system. The detection leverages Endpoint Detection and Response (EDR) telemetry, specifically focusing on command-line executions.
The analytic detects `rundll32.exe` loading a DLL export function by ordinal value. This behavior is significant because adversaries may use `rundll32.exe` to execute malicious code while evading security tools that do not monitor this process. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to system compromise, privilege escalation, or persistent access within the environment.
Detects the execution of the Qakbot uninstaller file, identified by its filename or specific file hashes, as mentioned in the USAO-CDCA document regarding the disruption of the Qakbot malware and botnet. This rule helps identify systems where the Qakbot uninstaller has been run, which could indicate remediation efforts or system compromise.
Detects the creation of an ISO file in the Outlook temporary folder or in the AppData temporary folder. This activity is typical of Qakbot TTPs observed from late July 2022, often associated with bypassing Mark-of-the-Web controls.
Detects the execution of 'rundll32.exe' where the loaded DLL does not have a '.dll' extension, often observed in Qakbot activity. The rule specifically looks for 'rundll32.exe' being spawned by common scripting or command-line interpreters and for the command line to contain paths frequently used by Qakbot for its payloads.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
This rule detects the execution of 'rundll32.exe' when it is spawned by specific parent processes (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and the command line contains paths commonly used by Qakbot for persistence or execution (e.g., ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming) along with a '.dll' extension. This combination of indicators is often associated with Qakbot malware activity.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments and parent processes that are characteristic of Qakbot malware activity. It looks for 'rundll32.exe' being launched by common scripting or command-line interpreters (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and attempting to load DLLs from suspicious paths (ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming). Additionally, it specifically targets known export functions used by Qakbot, such as 'aslr', 'bind', 'DrawThemeIcon', 'GG10', 'GL70', 'jhbvygftr', 'kjhbhkjvydrt', 'LS88', 'Motd', 'N115', 'next', 'Nikn', 'print', 'qqqb', 'qqqq', 'RS32', 'Test', 'Time', 'Updt', 'vips', 'Wind', 'WW50', 'X555', 'XL55', 'xlAutoOpen', and 'XS88'. This combination of indicators aims to reduce false positives by focusing on behaviors uniquely associated with Qakbot.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Detects the usage of "reg.exe" to add Windows Defender folder exclusions. This technique has been observed being used by QakBot (formerly Qbot) to add exclusions for folders within AppData and ProgramData, aiming to evade detection by the antivirus software.
Detects the execution of 'wermgr.exe' from an unusual or suspicious file path. Legitimate 'wermgr.exe' executions typically originate from 'C:\Windows\System32\', 'C:\Windows\SysWOW64\', or 'C:\Windows\WinSxS\'. Adversaries may rename or move legitimate Windows binaries to evade detection or blend in with normal system activity.
Page 4 of 4