detection.wiki

Detection rules › Sigma

Potential Qakbot Registry Activity

Status
test
Severity
high
Log source
product windows, category registry_event
Author
Hieu Tran
Source
github.com/SigmaHQ/sigma

Detects a registry key used by IceID in a campaign that distributes malicious OneNote files

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1112 Modify Registry
Defense ImpairmentT1112 Modify Registry

Event coverage

ProviderEventTitle
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)

Rule body yaml

title: Potential Qakbot Registry Activity
id: 1c8e96cd-2bed-487d-9de0-b46c90cade56
status: test
description: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files
references:
    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
author: Hieu Tran
date: 2023-03-13
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Software\firm\soft\Name'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|endswith: '\Software\firm\soft\Name'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectends_with
  • \Software\firm\soft\Name