Esentutl Steals Browser Information

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: frack113
Source: github.com/SigmaHQ/sigma

One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe

Known false positives

Legitimate use

MITRE ATT&CK coverage

Tactic	Techniques
Collection	`T1005` Data from Local System

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Esentutl Steals Browser Information
id: 6a69f62d-ce75-4b57-8dce-6351eb55b362
status: test
description: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe
references:
    - https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
    - https://redcanary.com/threat-detection-report/threats/qbot/
    - https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/
author: frack113
date: 2022-02-13
modified: 2024-03-05
tags:
    - attack.collection
    - attack.t1005
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\esentutl.exe'
        - OriginalFileName: 'esentutl.exe'
    selection_flag:
        CommandLine|contains|windash: '-r'
    selection_webcache:
        CommandLine|contains: '\Windows\WebCache'
    condition: all of selection*
falsepositives:
    - Legitimate use
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\esentutl.exe'
    - OriginalFileName: 'esentutl.exe'

Stage 2: `selection_flag`

selection_flag:
    CommandLine|contains|windash: '-r'

Stage 3: `selection_webcache`

selection_webcache:
    CommandLine|contains: '\Windows\WebCache'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-r` transforms: `windash` corpus 13 (sigma 9, kusto 4) `\Windows\WebCache`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\esentutl.exe` corpus 7 (sigma 7)	`field:"Image" kind:ends_with value:"\esentutl.exe"`
`OriginalFileName`	eq	`esentutl.exe` corpus 5 (sigma 2, elastic 2, splunk 1)	`field:"OriginalFileName" kind:eq value:"esentutl.exe"`