diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index dc2ca5fba4..b5650460c0 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - FIN7 + - Qakbot - CISA AA22-277A confidence: 80 context: diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index b8bd66a4da..c60602c952 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -34,6 +34,7 @@ tags: - IcedID - Windows Registry Abuse - Azorult + - Qakbot confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 40babd109a..fb8ce4def0 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -45,6 +45,7 @@ tags: - NOBELIUM Group - WhisperGate - DarkCrystal RAT + - Qakbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 2402aa03ff..7b14d9b4ef 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index df19829af4..8fada46320 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot - CISA AA22-277A confidence: 50 context: diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 65fe2d20ec..3173958bb3 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot - CISA AA22-277A confidence: 30 context: diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 45919d38b8..0bb55f9c13 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -35,6 +35,7 @@ tags: - Domain Trust Discovery - IcedID - Active Directory Discovery + - Qakbot asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index e97203d479..d1f9a35ae9 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -33,6 +33,7 @@ tags: - IcedID - DarkCrystal RAT - AgentTesla + - Qakbot confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index c10f5701a9..2fc2c7e3f6 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -34,6 +34,7 @@ tags: - Hermetic Wiper - Ransomware - Malicious PowerShell + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 8aa950d343..b26be86d4d 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -1,9 +1,9 @@ name: Recon Using WMI Class id: 018c1972-ca07-11eb-9473-acde48001122 version: 2 -date: '2022-02-25' +date: '2022-10-10' author: Teoderick Contreras, Splunk -type: TTP +type: Anomaly datamodel: [] description: The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running @@ -13,8 +13,8 @@ description: The following analytic identifies suspicious PowerShell via EventCo related artifacts. search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" - OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" - OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) + OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_PnPEntity*" + OR ScriptBlockText= "*Win32_ShadowCopy*" OR ScriptBlockText= "*Win32_DiskDrive*" OR ScriptBlockText= "*Win32_PhysicalMemory*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`' how_to_implement: To successfully implement this analytic, you will need to enable @@ -34,6 +34,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - Industroyer2 + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d8403bae72..b5f44b75ae 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -50,6 +50,7 @@ tags: - Remcos - Windows Registry Abuse - Azorult + - Qakbot asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index a862143fbc..4870a430ed 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -36,6 +36,7 @@ tags: - Suspicious Regsvr32 Activity - Remcos - Living Off The Land + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index c82272cb34..ace0b4e214 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -36,6 +36,7 @@ tags: - DarkCrystal RAT - CISA AA22-257A - AgentTesla + - Qakbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index ed33560e2e..119da0b173 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -29,6 +29,7 @@ tags: - XMRig - Industroyer2 - CISA AA22-257A + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index e0d6415762..f69a307994 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -39,6 +39,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - Azorult + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index ccf62a7fd0..7cb3ae205e 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Windows Persistence Techniques + - Qakbot confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index a645c9e324..0501f48736 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Suspicious WMI Use + - Qakbot cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 65237b9068..1b1d2d0890 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -34,6 +34,7 @@ tags: - Industroyer2 - DarkCrystal RAT - CISA AA22-257A + - Qakbot confidence: 100 context: - Source:Endpoint diff --git a/stories/qakbot.yml b/stories/qakbot.yml new file mode 100644 index 0000000000..e9241f2ed7 --- /dev/null +++ b/stories/qakbot.yml @@ -0,0 +1,25 @@ +name: Qakbot +id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 +version: 1 +date: '2022-10-12' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. + Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals + financial data from infected or compromised system. +narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz + for its malicious activities. This malware was on the CISA top malware list for 2021. +references: +- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf +- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot +- https://securelist.com/qakbot-technical-analysis/103931/ +- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails +tags: + analytic_story: Qakbot + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection