QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

calendar Mar 18, 2025 · attack.persistence attack.privilege-escalation attack.t1053.005  ·
Share on: linkedin copy

Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line

Sigma rule (View on GitHub)

 1title: QBot process creation from scheduled task REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line
 2id: 33d9c3f4-57a6-4ddb-a2a0-b2ccf8482607
 3status: test
 4description: Detects the process creation from Scheduled Task with REGSVR32 (regsvr32.exe), -s flag and SYSTEM in the command line
 5author: tas_kmanager, TheDFIRReport
 6references:
 7    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
 8date: 2022-02-06
 9modified: 2024-02-23
10logsource:
11    category: process_creation
12    product: windows
13detection:
14    selection:
15        CommandLine|contains|all:
16            - 'schtasks.exe'
17            - 'regsvr32.exe -s'
18            - 'SYSTEM'
19    condition: selection
20falsepositives:
21    - unknown
22level: high
23tags:
24    - attack.persistence
25    - attack.privilege-escalation
26    - attack.t1053.005

References

  • Qbot Likes to Move It, Move It

    Qbot (aka QakBot, Quakbot, Pinkslipbot ) has been around for a long time having first been observed back in 2007. More info on Qbot can be found at the following links: Microsoft & Red Canary I…


    Read More

Related rules

to-top