Qakbot Regsvr32 Calc Pattern

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•1•0•22

Detects a specific command line of "regsvr32" where the "calc" keyword is used in conjunction with the "/s" flag. This behavior is often seen used by Qakbot.