2022_QakBot

Malicious QakBot Dropped File Creation (Event 4663)

Sep 1, 2023 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.

Suspicious Calc Child Process

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of calc

Suspicious Command Arguments from Explorer or Wermgr

Sep 1, 2023 · attack.discovery attack.t1082 ·

Share on:

Detects the suspicious command line arguments from potentially-injected versions of explorer or wermgr processes.

Suspicious Process Injection to Explorer

Sep 1, 2023 · attack.defense_evasion attack.t1218 ·

Share on:

Detects the suspicious child process of regsvr32

Suspicious Schtasks Child Process

Nov 19, 2022 · attack.persistence attack.t1053 attack.t1053.005 ·

Share on:

Detects schtasks being run as a child process of explorer.exe to create a schedule task.

Suspicious Calc DLL Load

Nov 19, 2022 · attack.persistence attack.t1574 ·

Share on:

Detects Windows 7 calc.exe loading DLLs from suspicious or abnormal file paths.

Malicious QakBot Dropped File Creation (Sysmon)

Nov 18, 2022 · attack.initial_access attack.defense_evasion attack.t1566 attack.t1027 attack.t1553 ·

Share on:

Detects creation of files potentially associated with QakBot initial infection, documented by Adithya Chandra and Sushant Kumar Arya of Trellix in August 2022.