Merge pull request splunk#2419 from splunk/qakbot_2

qakbot_2

Author: patel-bhavin

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -39,6 +39,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - ProxyNotShell
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -1,7 +1,7 @@
 name: Cmdline Tool Not Executed In CMD Shell
 id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-10-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -15,8 +15,10 @@ description: The following analytic identifies a non-standard parent process (no
   This TTP is a good indicator for an adversary gathering host information, but one
   possible false positive might be an automated tool used by a system administator.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
-  OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe"
+  OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" 
+  OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe"
+  OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name
   = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe"
   OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
@@ -38,6 +40,7 @@ tags:
   - FIN7
   - Qakbot
   - CISA AA22-277A
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Qakbot
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -46,6 +46,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 7

detections/endpoint/suspicious_process_file_path.yml

@@ -42,6 +42,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -39,6 +39,7 @@ tags:
   - Suspicious Regsvr32 Activity
   - Icedid
   - Living Off The Land
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -37,6 +37,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Masquerading - Rename System Utilities
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_user_discovery_with_whoami.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Trickbot
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint