Potential QakBot Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.