Windows Process Creation: Qakbot-like rundll32 exports via script or cmd parent

title: "Windows Process Creation: Qakbot-like rundll32 exports via script or cmd parent"
id: 8525c610-5cfe-4af5-8ffe-4edf530338d5
status: test
description: This rule identifies suspicious process creation where rundll32.exe is launched with a command line containing Qakbot-associated paths and specific export-like parameters. It requires the rundll32 execution to be spawned by common script/cmd utilities (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell/pwsh.exe, or wscript.exe) to reflect likely staged execution. Telemetry relies on Windows process creation events, including parent image, child image, and command line contents.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
modified: 2023-05-30
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection_paths:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  selection_exports:
    CommandLine|endswith:
      - aslr
      - bind
      - DrawThemeIcon
      - GG10
      - GL70
      - jhbvygftr
      - kjhbhkjvydrt
      - LS88
      - Motd
      - N115
      - next
      - Nikn
      - print
      - qqqb
      - qqqq
      - RS32
      - Test
      - Time
      - Updt
      - vips
      - Wind
      - WW50
      - X555
      - XL55
      - xlAutoOpen
      - XS88
  condition: all of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 339ed3d6-5490-46d0-96a7-8abe33078f58
    type: derived