From c96c6d03d39a6b1dd6fff670f09f6fd5e294bb4b Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 18 Oct 2022 11:57:58 +0200 Subject: [PATCH 1/4] qakbot_1 --- ...cmdline_tool_not_executed_in_cmd_shell.yml | 1 + .../disable_defender_spynet_reporting.yml | 1 + ...s_powershell_process___encoded_command.yml | 1 + .../network_connection_discovery_arp.yml | 1 + .../network_connection_discovery_netstat.yml | 1 + ...work_discovery_using_route_windows_app.yml | 1 + .../nltest_domain_trust_discovery.yml | 1 + .../office_document_executing_macro_code.yml | 1 + .../recon_avproduct_through_pwh_or_wmi.yml | 1 + detections/endpoint/recon_using_wmi_class.yml | 7 +++--- .../registry_keys_used_for_persistence.yml | 1 + ...svr32_with_known_silent_switch_cmdline.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/schtasks_run_task_on_demand.yml | 1 + ...dows_defender_exclusion_registry_entry.yml | 1 + .../windows_schtasks_create_run_as_system.yml | 1 + .../windows_wmi_process_call_create.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 1 + stories/qakbot.yml | 25 +++++++++++++++++++ 19 files changed, 46 insertions(+), 3 deletions(-) create mode 100644 stories/qakbot.yml diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index c8f69706d3..adae5b3265 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -36,6 +36,7 @@ references: tags: analytic_story: - FIN7 + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index b8bd66a4da..c60602c952 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -34,6 +34,7 @@ tags: - IcedID - Windows Registry Abuse - Azorult + - Qakbot confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 40babd109a..fb8ce4def0 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -45,6 +45,7 @@ tags: - NOBELIUM Group - WhisperGate - DarkCrystal RAT + - Qakbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 2402aa03ff..7b14d9b4ef 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index 59fcabd767..d7cecbc8f4 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index ebf5e23634..938530ae2c 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Discovery + - Qakbot confidence: 30 context: - Source:Endpoint diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 45919d38b8..0bb55f9c13 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -35,6 +35,7 @@ tags: - Domain Trust Discovery - IcedID - Active Directory Discovery + - Qakbot asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index e97203d479..d1f9a35ae9 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -33,6 +33,7 @@ tags: - IcedID - DarkCrystal RAT - AgentTesla + - Qakbot confidence: 50 context: - Source:Endpoint diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index c10f5701a9..2fc2c7e3f6 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -34,6 +34,7 @@ tags: - Hermetic Wiper - Ransomware - Malicious PowerShell + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 8aa950d343..a9806b9757 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -1,9 +1,9 @@ name: Recon Using WMI Class id: 018c1972-ca07-11eb-9473-acde48001122 version: 2 -date: '2022-02-25' +date: '2022-10-10' author: Teoderick Contreras, Splunk -type: TTP +type: Anomaly datamodel: [] description: The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running @@ -13,7 +13,7 @@ description: The following analytic identifies suspicious PowerShell via EventCo related artifacts. search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" - OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" + OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_PnPEntity*" OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`' @@ -34,6 +34,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - Industroyer2 + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d8403bae72..b5f44b75ae 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -50,6 +50,7 @@ tags: - Remcos - Windows Registry Abuse - Azorult + - Qakbot asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index a862143fbc..4870a430ed 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -36,6 +36,7 @@ tags: - Suspicious Regsvr32 Activity - Remcos - Living Off The Land + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index c82272cb34..ace0b4e214 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -36,6 +36,7 @@ tags: - DarkCrystal RAT - CISA AA22-257A - AgentTesla + - Qakbot asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index ed33560e2e..119da0b173 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -29,6 +29,7 @@ tags: - XMRig - Industroyer2 - CISA AA22-257A + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index e0d6415762..f69a307994 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -39,6 +39,7 @@ tags: - Remcos - Windows Defense Evasion Tactics - Azorult + - Qakbot confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index ccf62a7fd0..7cb3ae205e 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Windows Persistence Techniques + - Qakbot confidence: 60 context: - Source:Endpoint diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index a645c9e324..0501f48736 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -30,6 +30,7 @@ references: tags: analytic_story: - Suspicious WMI Use + - Qakbot cis20: - CIS 3 - CIS 5 diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 65237b9068..1b1d2d0890 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -34,6 +34,7 @@ tags: - Industroyer2 - DarkCrystal RAT - CISA AA22-257A + - Qakbot confidence: 100 context: - Source:Endpoint diff --git a/stories/qakbot.yml b/stories/qakbot.yml new file mode 100644 index 0000000000..2138155c7e --- /dev/null +++ b/stories/qakbot.yml @@ -0,0 +1,25 @@ +name: Qakbot +id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 +version: 1 +date: '2022-10-1210' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities + that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. + Qakbot is a modular information stealer that has been active since 2007. It is also has historical background to be banking Trojan that steals + financial data from infected or compromised system. +narrative: Qakbot is also known to leverage tools like powershell, process injection, and mimikatz + for its malicious activities. This malware was on the CISA top malware list for 2021. +references: +- https://www.cisa.gov/sites/default/files/publications/202010221030_QakBot%20TLPWHITE.pdf +- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot +- https://securelist.com/qakbot-technical-analysis/103931/ +- https://www.fortinet.com/blog/threat-research/new-variant-of-qakbot-spread-by-phishing-emails +tags: + analytic_story: Qakbot + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From f217d96ae98aec3e7e467dd3c0ec3b86e7caa795 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Tue, 18 Oct 2022 12:02:39 +0200 Subject: [PATCH 2/4] Update qakbot.yml --- stories/qakbot.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/stories/qakbot.yml b/stories/qakbot.yml index 2138155c7e..e9241f2ed7 100644 --- a/stories/qakbot.yml +++ b/stories/qakbot.yml @@ -1,7 +1,7 @@ name: Qakbot id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 version: 1 -date: '2022-10-1210' +date: '2022-10-12' author: Teoderick Contreras, Splunk description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Qakbot/QBot malware including parent-child process anomalies, persistence, initial access, recon and many more. @@ -22,4 +22,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection From 1da68fe602b27d7fbcd68d314a40b90afb421e74 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Oct 2022 11:32:48 +0200 Subject: [PATCH 3/4] Update recon_using_wmi_class.yml --- detections/endpoint/recon_using_wmi_class.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index a9806b9757..c4812967bd 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -14,7 +14,7 @@ description: The following analytic identifies suspicious PowerShell via EventCo search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_PnPEntity*" - OR ScriptBlockText= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) + OR ScriptBlockText= "*Win32_ShadowCopy*" OR ScriptBlockText= "*Win32_DiskDrive*" OR ScriptBlockText= "*Win32_PhysicalMemory*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`' how_to_implement: To successfully implement this analytic, you will need to enable From 66948df0b87b54e44063cb8ca171f72f73a6d07c Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 21 Oct 2022 11:33:40 +0200 Subject: [PATCH 4/4] Update recon_using_wmi_class.yml --- detections/endpoint/recon_using_wmi_class.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index c4812967bd..b26be86d4d 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -13,7 +13,7 @@ description: The following analytic identifies suspicious PowerShell via EventCo related artifacts. search: '`powershell` EventCode=4104 (ScriptBlockText= "*SELECT*" OR ScriptBlockText= "*Get-WmiObject*") AND (ScriptBlockText= "*Win32_Bios*" OR ScriptBlockText= "*Win32_OperatingSystem*" OR ScriptBlockText= "*Win32_Processor*" - OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_ComputerSystemProduct*" OR ScriptBlockText= "*Win32_PnPEntity*" + OR ScriptBlockText= "*Win32_ComputerSystem*" OR ScriptBlockText= "*Win32_PnPEntity*" OR ScriptBlockText= "*Win32_ShadowCopy*" OR ScriptBlockText= "*Win32_DiskDrive*" OR ScriptBlockText= "*Win32_PhysicalMemory*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter`'