Qakbot

Qakbot Uninstaller Execution

Sep 1, 2023 · detection.emerging_threats attack.execution ·

Detects the execution of the Qakbot uninstaller file mentioned in the USAO-CDCA document on the disruption of the Qakbot malware and botnet

Potential Qakbot Rundll32 Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution often linked with potential Qakbot activity.

Qakbot Regsvr32 Calc Pattern

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot

Qakbot Rundll32 Exports Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Qakbot Rundll32 Fake DLL Extension Execution

Jun 20, 2023 · attack.defense_evasion attack.execution detection.emerging_threats ·

Share on:

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.