Qakbot

Potential Qakbot Rundll32 Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Qakbot Regsvr32 Calc Pattern

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Qakbot Rundll32 Exports Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Qakbot Rundll32 Fake DLL Extension Execution

Aug 12, 2024 · attack.defense-evasion attack.execution detection.emerging-threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

Qakbot Uninstaller Execution

Aug 12, 2024 · detection.emerging-threats attack.execution ·

Share on:

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet