QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

calendar Feb 23, 2024 · attack.persistence attack.privilege_escalation attack.t1053.005  ·
Share on: linkedin copy

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Sigma rule (View on GitHub)

 1title: QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line
 2id: 33d9c3f4-57a6-4ddb-a2a0-b2ccf8482607
 3status: test
 4description: Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line 
 5author: tas_kmanager, TheDFIRReport
 6references: 
 7    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 8date: 2022-02-06
 9modified: 2024-02-23
10logsource:
11  category: process_creation
12  product: windows
13detection:
14  selection:
15    CommandLine|contains|all: 
16      - 'schtasks.exe'
17      - 'regsvr32.exe -s'
18      - 'SYSTEM'
19  condition: selection
20falsepositives:
21  - unknown
22level: high
23tags:
24  - attack.persistence
25  - attack.privilege_escalation
26  - attack.t1053.005

References

  • Qbot Likes to Move It, Move It

    Qbot (aka QakBot, Quakbot, Pinkslipbot ) has been around for a long time having first been observed back in 2007. More info on Qbot can be found at the following links: Microsoft & Red Canary I…


    Read More

Related rules

to-top