QBot Mounted Drive Execution (RedCanary Threat Detection Report)

calendar May 10, 2023 · attack.s0650  ·
Share on: linkedin copy

Detects process creation from wscript or cscript interpreters with commands occuring on mounted drive letters. Defenders should check whether these processes have child processes. Part of the RedCanary 2023 Threat Detection Report.

Sigma rule (View on GitHub)

 1title: QBot Mounted Drive Execution (RedCanary Threat Detection Report)
 2id: 949afe0b-2d45-4999-be9c-fe4808b8a68b
 3status: experimental
 4description: Detects process creation from wscript or cscript interpreters with commands occuring on mounted drive letters. Defenders should check whether these processes have child processes. Part of the RedCanary 2023 Threat Detection Report.
 5references:
 6    - https://redcanary.com/threat-detection-report/threats/qbot/
 7author: RedCanary, Sigma formatting by Micah Babinski
 8date: 2023/05/10
 9tags:
10    - attack.s0650
11logsource:
12    category: process_creation
13    product: windows
14detection:
15    selection:
16        ParentImage|endswith: '\explorer.exe'
17        Image|endswith:
18            - '\wscript.exe'
19            - '\cscript.exe'
20        CommandLine|re: '[d-z]:\\[^\\]+\.(?:js|vbs|wsf)'
21    condition: selection
22falsepositives:
23    - Unknown
24level: low```

References

Related rules

to-top