From c2cef88a36acd0d80a4141d2ceca3263d0b2ee2b Mon Sep 17 00:00:00 2001
From: tccontre <tccontre18@gmail.com>
Date: Thu, 27 Oct 2022 15:21:05 +0200
Subject: [PATCH] qakbot_2

---
 .../endpoint/system_processes_run_from_unexpected_locations.yml  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
index f17fcdf50b..980c97ef0a 100644
--- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml
+++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml
@@ -37,6 +37,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Masquerading - Rename System Utilities
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8