Skip to content

qakbot_2 - #2419

Merged
patel-bhavin merged 36 commits into
developfrom
qakbot_2
Nov 1, 2022
Merged

qakbot_2#2419
patel-bhavin merged 36 commits into
developfrom
qakbot_2

Conversation

@tccontre

@tccontre tccontre commented Oct 20, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

Details

  • system_user_discovery_with_whoami.yml
  • windows_dll_side_loading_process_child_of_calc.yml
  • windows_masquerading_explorer_as_child_process.yml
  • windows_system_discovery_using_ldap_nslookup.yml
  • windows_system_discovery_using_qwinsta.yml
  • windows_dll_side_loading_in_calc.yml
  • windows_modify_registry_qakbot_binary_data_registry.yml
  • windows_wmi_impersonate_token.yml
  • windows_command_shell_fetch_env_variables.yml
  • windows_process_injection_wermgr_child_process.yml
  • windows_regsvr32_renamed_binary.yml
  • windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml
  • windows_process_injection_of_wermgr_to_known_browser.yml
  • windows_process_injection_remote_thread.yml

What does this PR have in it? Screenshots are worth 1000 words 😄

modified

  • cmd_carry_out_string_command_parameter.yml
  • suspicious_regsvr32_register_suspicious_path.yml
  • cmdline_tool_not_executed_in_cmd_shell.yml
  • executables_or_script_creation_in_suspicious_path.yml
  • suspicious_process_file_path.yml
  • process_creating_lnk_file_in_suspicious_location.yml
  • system_processes_run_from_unexpected_locations.yml
  • system_user_discovery_with_whoami.yml
  • create_remote_thread_in_shell_application.yml
  • wermgr_process_spawned_cmd_or_powershell_process.yml

Checklist

Screenshot 2022-10-20 at 12 12 43

Screenshot 2022-10-28 at 10 06 31

Screenshot 2022-10-27 at 16 54 45

Screenshot 2022-10-28 at 11 29 53

Screenshot 2022-10-20 at 12 27 00

Screenshot 2022-10-21 at 11 12 56

Screenshot 2022-10-21 at 11 22 55

Screenshot 2022-10-25 at 10 30 08

Screenshot 2022-10-24 at 14 23 56

  • Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
  • CI/CD jobs passed ✔️
  • Validated SPL logic.
  • Validated tags, description, and how to implement.
  • Verified references match analytic.

@tccontre
tccontre requested a review from P4T12ICK October 20, 2022 11:45
@tccontre tccontre added the WIP DO NOT MERGE Work in Progress label Oct 24, 2022
@tccontre
tccontre requested a review from patel-bhavin October 26, 2022 10:55
@tccontre
tccontre requested review from MHaggis and removed request for P4T12ICK October 27, 2022 14:31
@tccontre tccontre removed the WIP DO NOT MERGE Work in Progress label Oct 31, 2022
@patel-bhavin

patel-bhavin commented Oct 31, 2022

Copy link
Copy Markdown
Contributor

LGTM!

@patel-bhavin patel-bhavin reopened this Nov 1, 2022
@patel-bhavin
patel-bhavin merged commit aa27dd3 into develop Nov 1, 2022
@delete-merged-branch
delete-merged-branch Bot deleted the qakbot_2 branch November 1, 2022 17:00
@ljstella ljstella removed the 4.6.0 label Jun 21, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@patel-bhavin patel-bhavin patel-bhavin approved these changes
@MHaggis MHaggis Awaiting requested review from MHaggis

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tccontre @patel-bhavin @ljstella @srv-rr-gh-researchbt