attack.s0650

Qbot Mounted Drive Script Executions

Mar 26, 2024 · attack.s0650 attack.execution attack.t1059 attack.t1204 ·

Detects Windows Scripting Host processes (wscript.exe and cscript.exe) that are invoking the execution of common scripting formats that Red Canary has observed being used by Qbot—such as .js, .vbs, and .wsf—that are from a logical mounted drive using the drive letters D: through Z: and that have a child process. Part of the RedCanary 2024 Threat Detection Report.

QBot rundll32.exe Non-standard File Proxy Execution (RedCanary Threat Detection Report)

Jun 2, 2023 · attack.s0650 ·

Share on:

Detects Rundll32.exe process creations with non-standard file types denoted by excluding the common file types from the command-=line selection. Part of the RedCanary 2023 Threat Detection Report.

QBot Mounted Drive Execution (RedCanary Threat Detection Report)

May 10, 2023 · attack.s0650 ·

Share on:

Detects process creation from wscript or cscript interpreters with commands occuring on mounted drive letters. Defenders should check whether these processes have child processes. Part of the RedCanary 2023 Threat Detection Report.

ISO, VHD, LNK or IMG File Extracted from Zip (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 attack.t1564 ·

Share on:

Detects extraction of ISO, VHD, LNK, or IMG files from zip files. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Old)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Suspicious User-Initiated Process Execution on External Drive (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.execution attack.t1059 attack.t1204 attack.t1204.002 ·

Share on:

Detects command/scripting interpreter-created processes executing on an external drive. This will detect common instances of malware using LNK files to obscure malicious commands for user execution. Commonly associated with QakBot and IcedID.

Web Browser Creates Zip Archive File (Sysmon)

Dec 28, 2022 · attack.s0650 attack.s0483 attack.defense_evasion attack.t1027 attack.t1027.006 ·

Share on:

Detects browser applications creating archive/container files such as zip, rar, or 7z, as occurs during an HTML smuggling attack where a browser decodes and executes malicious code within an HTML file. Commonly associated with QakBot and IcedID.

Application Bypass with RunDLL32 and DllRegisterServer Function

Nov 9, 2022 · attack.defense_evasion attack.t1218 attack.t1218.011 attack.s0650 attack.s0386 ·

Share on:

DLLs that are designed to be loaded by Regsvr32 are expected to have a DllRegisterServer export function implemented. This detects use of the same DLL to rundll32.exe. Inspired by the 2022 Red Canary Threat Detection report.