Detection rules › Splunk
Esentutl.exe Collecting Browser Data (Sysmon)
Esentutl.exe is a Windows command line utility that provides database utilities for the Extensible Storage Engine (ESE). While esentutl.exe is a legitimate and useful tool within Windows environments, its abuse has been observed in malware infections including Qakbot, where it has been used to collect data from Internet Explorer and Microsoft Edge. This use case detects command line arguments used with esentutl.exe to collect data from web browsers
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Collection | T1005 Data from Local System |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '24860.46041'
title: Esentutl.exe Collecting Browser Data
description: 'Esentutl.exe is a Windows command line utility that provides database
utilities for the Extensible Storage Engine (ESE). While esentutl.exe is a legitimate
and useful tool within Windows environments, its abuse has been observed in malware
infections including Qakbot, where it has been used to collect data from Internet
Explorer and Microsoft Edge. This use case detects command line arguments used with
esentutl.exe to collect data from web browsers. -- Software Association: Akira --
Living Off the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
"esentutl.exe" OR ("/r " "\\Windows\\WebCache") | where match(process, "(?i)\s/r\s.*\x5cWindows\x5cWebCache")
| table _time, host, user, signature_id, process, process_*, parent_* | bin span=1s
| stats values(*) as * by _time, host '
techniques:
- collection:data from local system
technique_id:
- T1005
data_category:
- Windows Sysmon
references:
- https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/
- https://www.cybereason.com/blog/threat-alert-aggressive-qakbot-campaign-and-the-black-basta-ransomware-group-targeting-u.s.-companies
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") "esentutl.exe" OR ("/r " "\\Windows\\WebCache")
Stage 2: where
| where match(process, "(?i)\s/r\s.*\x5cWindows\x5cWebCache")
Stage 3: table
| table _time, host, user, signature_id, process, process_*, parent_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | "esentutl.exe" |
| 1 | "/r " |
| 1 | "\\Windows\\WebCache" |