hightestEmerging Threat
Qakbot Regsvr32 Calc Pattern
Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot
windowsprocess_creation
2024-03-05
Emerging Threats
Malware2023
Qakbot
5Rules
4References
1Folders
2024-03-05Latest
Summary
Qakbot is tracked here as a malware family or toolset with 5 Sigma detections spanning 2023. Coverage centers on windows / process_creation.
Related Detections
Search this threathightestEmerging Threat
Qakbot Uninstaller Execution
Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet
windowsprocess_creation
2023-09-01
criticaltestEmerging Threat
Qakbot Rundll32 Exports Execution
Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.
windowsprocess_creation
2023-05-30
hightestEmerging Threat
Potential Qakbot Rundll32 Execution
Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.
windowsprocess_creation2 samples
2023-05-24
criticaltestEmerging Threat
Qakbot Rundll32 Fake DLL Extension Execution
Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.
windowsprocess_creation
2023-05-24
References