qakbot_2

detections/endpoint/cmd_carry_out_string_command_parameter.yml

@@ -39,6 +39,7 @@ tags:
   - Azorult
   - DarkCrystal RAT
   - ProxyNotShell
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml

@@ -1,7 +1,7 @@
 name: Cmdline Tool Not Executed In CMD Shell
 id: 6c3f7dd8-153c-11ec-ac2d-acde48001122
-version: 1
-date: '2021-09-14'
+version: 2
+date: '2022-10-27'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -15,8 +15,10 @@ description: The following analytic identifies a non-standard parent process (no
   This TTP is a good indicator for an adversary gathering host information, but one
   possible false positive might be an automated tool used by a system administator.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where  (Processes.process_name = "ipconfig.exe"
-  OR Processes.process_name = "systeminfo.exe") AND NOT (Processes.parent_process_name
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe"
+  OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" 
+  OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe"
+  OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name
   = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe"
   OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name
   Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id
@@ -38,6 +40,7 @@ tags:
   - FIN7
   - Qakbot
   - CISA AA22-277A
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/create_remote_thread_in_shell_application.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - IcedID
+  - Qakbot
   confidence: 100
   context:
   - Source:Endpoint

detections/endpoint/executables_or_script_creation_in_suspicious_path.yml

@@ -46,6 +46,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml

@@ -33,6 +33,7 @@ references:
 tags:
   analytic_story:
   - Spearphishing Attachments
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 7

detections/endpoint/suspicious_process_file_path.yml

@@ -42,6 +42,7 @@ tags:
   - DarkCrystal RAT
   - Brute Ratel C4
   - AgentTesla
+  - Qakbot
   automated_detection_testing: passed
   confidence: 50
   context:

detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml

@@ -39,6 +39,7 @@ tags:
   - Suspicious Regsvr32 Activity
   - Icedid
   - Living Off The Land
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_processes_run_from_unexpected_locations.yml

@@ -37,6 +37,7 @@ tags:
   - Unusual Processes
   - Ransomware
   - Masquerading - Rename System Utilities
+  - Qakbot
   asset_type: Endpoint
   cis20:
   - CIS 8

detections/endpoint/system_user_discovery_with_whoami.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Active Directory Discovery
+  - Qakbot
   confidence: 50
   context:
   - Source:Endpoint

detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml

@@ -29,6 +29,7 @@ references:
 tags:
   analytic_story:
   - Trickbot
+  - Qakbot
   confidence: 80
   context:
   - Source:Endpoint

detections/endpoint/windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml

@@ -0,0 +1,69 @@
+name: Windows App Layer Protocol Wermgr Connect To NamedPipe
+id: 2f3a4092-548b-421c-9caa-84918e1787ef
+version: 1
+date: '2022-10-28'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious wermgr.exe process creating or connecting to a named pipe. 
+  Wermgr.exe is part of Windows OS Problem reporting application responsible for reporting problems, fault or error happen on 
+  the Windows OS. This file is being abused by several Threat actors and malware such as Trickbot and Qakbot to execute their malicious 
+  code. This anomaly detection can be a good pivot on possible wermgr.exe processes having injected malicious code that might be related to 
+  qakbot infection that communicates via named pipe.
+search: '`sysmon` EventCode IN (17, 18) Image= "*\\wermgr.exe" EventType IN ( "CreatePipe", "ConnectPipe")
+  | stats  min(_time) as firstTime max(_time) as lastTime count by Image EventType ProcessGuid ProcessId PipeName SecurityID EventCode Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_app_layer_protocol_wermgr_connect_to_namedpipe_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, pipename, processguid and named pipe event type from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://strontic.github.io/xcyclopedia/library/wermgr.exe-0F652BF7ADA772981E8AAB0D108FCC92.html
+- https://www.trellix.com/en-us/about/newsroom/stories/research/demystifying-qbot-malware.html
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Command And Control
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr2/sysmon_wermgr2.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: wermgr.exe process is creating or connecting to a named pipe $PipeName$ in $Computer$
+  mitre_attack_id:
+  - T1071
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - EventType
+  - ProcessGuid 
+  - ProcessId 
+  - PipeName 
+  - Computer 
+  - UserID
+  - SecurityID
+  risk_score: 49
+  security_domain: endpoint

detections/endpoint/windows_command_shell_fetch_env_variables.yml

@@ -0,0 +1,75 @@
+name: Windows Command Shell Fetch Env Variables
+id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13
+version: 1
+date: '2022-10-27'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies a suspicious process command line fetching the environment variables with a non-shell parent process. 
+  This technique was seen in qakbot malware where it fetches the environment variable in the target or compromised host. This TTP detection is a good pivot 
+  of possible malicious behavior since the command line is executed by a common non-shell process like cmd.exe , powershell.exe and many more. 
+  This can also be a good sign that the parent process has a malicious code injected to it to execute this command.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process = "*cmd /c set" OR Processes.process = "*cmd.exe /c set" AND NOT (Processes.parent_process_name = "cmd.exe" 
+  OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe")
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id 
+  Processes.parent_process_id Processes.original_file_name 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_command_shell_fetch_env_variables_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: shell process that are not included in this search may cause False positive. Filter is needed.
+references:
+- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: non-shell parent process has a child process $process_name$ with a commandline $process$ to fetch env variables in $dest$
+  mitre_attack_id:
+  - T1055
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 56
+  security_domain: endpoint

detections/endpoint/windows_dll_side_loading_in_calc.yml

@@ -0,0 +1,63 @@
+name: Windows DLL Side-Loading In Calc
+id: af01f6db-26ac-440e-8d89-2793e303f137
+version: 1
+date: '2022-10-24'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious DLL modules loaded by calc.exe that are not in windows %systemroot%\system32 or %systemroot%\sysWoW64 folder. 
+  This technique is well used by Qakbot malware to execute its malicious DLL file via dll side loading technique in calc process execution. 
+  This TTP detection is a good indicator that a suspicious dll was loaded in a public or non-common installation folder of Windows Operating System that needs further investigation. 
+search: '`sysmon` EventCode=7 Image = "*\calc.exe" AND NOT (Image IN ("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*")) AND NOT(ImageLoaded IN("*:\\windows\\system32\\*", "*:\\windows\\sysWow64\\*", "*:\\windows\\WinSXS\\*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded OriginalFileName Product process_name Computer EventCode Signed ProcessId 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_dll_side_loading_in_calc_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on processes that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` and `Filesystem`
+  node. In addition, confirm the latest CIM App 4.20 or higher is installed and the
+  latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://www.bitdefender.com/blog/hotforsecurity/new-qakbot-malware-strain-replaces-windows-calculator-dll-to-infected-pcs/
+tags:
+  analytic_story:
+  - Qakbot
+  confidence: 100
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot2/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: a dll modules is loaded by calc.exe in $ImageLoaded$ that are not in common windows OS installation folder in $Computer$
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image
+  - ImageLoaded
+  - OriginalFileName
+  - Product
+  - process_name
+  - Computer
+  - EventCode
+  - Signed
+  - ProcessId
+  risk_score: 90
+  security_domain: endpoint
+  asset_type: Endpoint

detections/endpoint/windows_dll_side_loading_process_child_of_calc.yml

@@ -0,0 +1,75 @@
+name: Windows DLL Side-Loading Process Child Of Calc
+id: 295ca9ed-e97b-4520-90f7-dfb6469902e1
+version: 1
+date: '2022-10-20'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies the suspicious child process of calc.exe due to dll side loading technique to execute another executable. 
+  This technique was seen in qakbot malware that uses dll side loading technique to calc applications to load its malicious dll code. The malicious dll that abuses 
+  dll side loading technique will load the actual qakbot loader dll using regsvr32.exe application. 
+  This TTP is a good indicator of qakbot since the calc.exe will not load other child processes aside from win32calc.exe.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where (Processes.parent_process_name = "calc.exe")  AND Processes.process_name != "win32calc.exe"
+  by Processes.parent_process Processes.process_name Processes.process_id Processes.process_guid Processes.process Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` 
+  | `security_content_ctime(firstTime)` 
+  |`security_content_ctime(lastTime)` 
+  | `windows_dll_side_loading_process_child_of_calc_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information on process 
+  that include the name of the process responsible for the changes from your endpoints into the `Endpoint` 
+  datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and 
+  the latest TA for the endpoint product.
+known_false_positives: unknown
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot
+tags:
+  analytic_story:
+  - Qakbot
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  - Stage:Privilege Escalation
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/sysmon.log
+  impact: 90
+  kill_chain_phases:
+  - Exploitation
+  message: calc.exe has a child process $process_name$ in $dest$
+  mitre_attack_id:
+  - T1574.002
+  - T1574
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name #parent process name
+  - Processes.parent_process #parent cmdline
+  - Processes.original_file_name
+  - Processes.process_name #process name
+  - Processes.process #process cmdline
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 81
+  security_domain: endpoint