Potential QBot Execution on Windows via wscript, WinRAR parent, ping/type, and regsvr32

title: Potential QBot Execution on Windows via wscript, WinRAR parent, ping/type, and regsvr32
id: 3c30d5da-f448-4cd9-a9fd-8c1e0bf0b3a7
status: stable
description: This rule flags suspicious Windows process creation patterns where a wscript.exe execution is spawned from a WinRAR.exe parent and the command line contains a specific ping/type chain. It also matches cases where the command line includes regsvr32.exe along with a C:\ProgramData path and a .tmp filename, consistent with common script and DLL registration staging behaviors. Telemetry relies on Windows process creation events, including ParentImage, Image, and full CommandLine content.
references:
  - https://twitter.com/killamjr/status/1179034907932315648
  - https://app.any.run/tasks/2e0647b7-eb86-4f72-904b-d2d0ecac07d1/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/QBot/proc_creation_win_malware_qbot.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-10-01
modified: 2023-02-03
tags:
  - attack.execution
  - attack.t1059.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection1:
    ParentImage|endswith: \WinRAR.exe
    Image|endswith: \wscript.exe
  selection2:
    CommandLine|contains: " /c ping.exe -n 6 127.0.0.1 & type "
  selection3:
    CommandLine|contains|all:
      - regsvr32.exe
      - C:\ProgramData
      - .tmp
  condition: 1 of selection*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 4fcac6eb-0287-4090-8eea-2602e4c20040
    type: derived