Suspicious Process Injection to Explorer

calendar Sep 1, 2023 · attack.defense_evasion attack.t1218  ·
Share on: linkedin copy

Detects the suspicious child process of regsvr32

Sigma rule (View on GitHub)

 1title: Suspicious Process Injection to Explorer
 2id: ddef6008-8465-4ce6-b2ec-4e8ffef62a9a
 3status: experimental
 4description: Detects the suspicious child process of regsvr32
 5references:
 6    - https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
 7author: Adithya Chandra and Sushant Kumar Arya, Trellix
 8date: 2022/04/08
 9tags:
10    - attack.defense_evasion
11    - attack.t1218
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        ParentImage|endswith: '\regsvr32.exe'
18        Image|endswith: '\explorer.exe'
19    condition: selection
20falsepositives:
21    - Unknown
22level: high```

References

  • Demystifying Qbot Malware

    The Trellix SecOps Team has observed an uptick in the Qbot malware infections in recent months. This blog will highlight TTPs of Qbot malware, detection capabilities in Trellix products and some detection strategies.


    Read More

Related rules

to-top