Sigma rule: Qakbot Rundll32 Exports Execution

Rule

Title

Qakbot Rundll32 Exports Execution

Status

test

Level

critical

Author

X__Junior (Nextron Systems)

Date

2023-05-24

Modified

2023-05-30

File

rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects specific process tree behavior of a "rundll32" execution with exports linked with Qakbot activity.

Log source

product

windows

category

process_creation

Detection

selection_paths:
    ParentImage|endswith:
        # Note: Only add processes seen used by Qakbot to avoid collision with other strains of malware
        - '\cmd.exe'
        - '\cscript.exe'
        - '\curl.exe'
        - '\mshta.exe'
        - '\powershell.exe'
        - '\pwsh.exe'
        - '\wscript.exe'
    Image|endswith: '\rundll32.exe'
    CommandLine|contains:
        # Note: Only add paths seen used by Qakbot to avoid collision with other strains of malware
        - ':\ProgramData\'
        - ':\Users\Public\'
        - '\AppData\Local\Temp\'
        - '\AppData\Roaming\'
selection_exports:
    CommandLine|endswith:
        # Note: Only add additional exports seen used by Qakbot
        - 'aslr' # https://tria.ge/230524-scgq9add9v/behavioral1#report
        - 'bind'
        - 'DrawThemeIcon'
        - 'GG10'
        - 'GL70'
        - 'jhbvygftr'
        - 'kjhbhkjvydrt'
        - 'LS88'
        - 'Motd'
        - 'N115'
        - 'next' # https://tria.ge/230530-n3rxpahf9w/behavioral2
        - 'Nikn'
        - 'print'
        - 'qqqb'
        - 'qqqq'
        - 'RS32'
        - 'Test'
        - 'Time'
        - 'Updt'
        - 'vips'
        - 'Wind'
        - 'WW50'
        - 'X555'
        - 'XL55'
        - 'xlAutoOpen'
        - 'XS88'
condition: all of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• detection.emerging-threats
• attack.stealth

References

• https://github.com/pr0xylife/Qakbot/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml