Branch was auto-updated.

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -36,6 +36,7 @@ references:
 tags:
   analytic_story:
   - FIN7
+  - Qakbot
   - CISA AA22-277A
   confidence: 80
   context:

detections/endpoint/disable_defender_spynet_reporting.yml

@@ -34,6 +34,7 @@ tags:
   - IcedID
   - Windows Registry Abuse
   - Azorult
+  - Qakbot
   confidence: 70
   context:
   - Source:Endpoint

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -45,6 +45,7 @@ tags:
   - NOBELIUM Group
   - WhisperGate
   - DarkCrystal RAT
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/network_connection_discovery_arp.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/network_connection_discovery_netstat.yml

@@ -25,6 +25,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   - CISA AA22-277A
   confidence: 50
   context:

detections/endpoint/network_discovery_using_route_windows_app.yml

@@ -28,6 +28,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   - CISA AA22-277A
   confidence: 30
   context:

detections/endpoint/nltest_domain_trust_discovery.yml

@@ -35,6 +35,7 @@ tags:
   - Domain Trust Discovery
   - IcedID
   - Active Directory Discovery
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/office_document_executing_macro_code.yml

@@ -33,6 +33,7 @@ tags:
   - IcedID
   - DarkCrystal RAT
   - AgentTesla
+  - Qakbot
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -34,6 +34,7 @@ tags:
   - Hermetic Wiper 
   - Ransomware
   - Malicious PowerShell
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/recon_using_wmi_class.yml

@@ -1,9 +1,9 @@
 name: Recon Using WMI Class
 id: 018c1972-ca07-11eb-9473-acde48001122
 version: 2
-date: '2022-02-25'
+date: '2022-10-10'
 author: Teoderick Contreras, Splunk
-type: TTP
+type: Anomaly
 datamodel: []
 description: The following analytic identifies suspicious PowerShell via EventCode
   4104, where WMI is performing an event query looking for running processes or running
@@ -13,8 +13,8 @@ description: The following analytic identifies suspicious PowerShell via EventCo
   related artifacts.
 search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*")
   AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*"
-  OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*"
-  OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time)
+  OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_PnPEntity*" 
+  OR ScriptBlockText= "*Win32_ShadowCopy*" OR ScriptBlockText= "*Win32_DiskDrive*" OR ScriptBlockText= "*Win32_PhysicalMemory*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
@@ -34,6 +34,7 @@ tags:
   - Hermetic Wiper
   - Malicious PowerShell
   - Industroyer2
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -50,6 +50,7 @@ tags:
   - Remcos
   - Windows Registry Abuse
   - Azorult
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml

@@ -36,6 +36,7 @@ tags:
   - Suspicious Regsvr32 Activity
   - Remcos
   - Living Off The Land
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml

@@ -36,6 +36,7 @@ tags:
   - DarkCrystal RAT
   - CISA AA22-257A
   - AgentTesla
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 3

detections/endpoint/schtasks_run_task_on_demand.yml

@@ -29,6 +29,7 @@ tags:
   - XMRig
   - Industroyer2
   - CISA AA22-257A
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_defender_exclusion_registry_entry.yml

@@ -39,6 +39,7 @@ tags:
   - Remcos
   - Windows Defense Evasion Tactics
   - Azorult
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_schtasks_create_run_as_system.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Windows Persistence Techniques
+  - Qakbot
   confidence: 60
   context:
   - Source:Endpoint

detections/endpoint/windows_wmi_process_call_create.yml

@@ -30,6 +30,7 @@ references:
 tags:
   analytic_story:
   - Suspicious WMI Use
+  - Qakbot
   cis20:
   - CIS 3
   - CIS 5

detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml

@@ -34,6 +34,7 @@ tags:
   - Industroyer2
   - DarkCrystal RAT
   - CISA AA22-257A
+  - Qakbot
   confidence: 100
   context:
   - Source:Endpoint

stories/qakbot.yml

@@ -0,0 +1,25 @@
+name: Qakbot
+id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6
+version: 1
+date: '2022-10-12'
+author: Teoderick Contreras, Splunk
+description: Leverage searches that allow you to detect and investigate unusual activities
+  that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more.
+  Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals 
+  financial data from infected or compromised system. 
+narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz 
+  for its malicious activities. This malware was on the CISA top malware list for 2021. 
+references:
+- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
+- https://securelist.com/qakbot-technical-analysis/103931/
+- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails
+tags:
+  analytic_story: Qakbot
+  category:
+  - Malware
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection