Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings
Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.
FreeReviewedSigma · Critical · v5
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-24
- Updated
- 2026-07-31
What it detects
This rule identifies Windows process creation where rundll32.exe is launched by specific scripting/command interpreters and the command line contains Qakbot-associated ProgramData/Public/AppData/Temp paths. It further matches command-line endings tied to a set of export identifiers commonly used in Qakbot execution flows. The detection relies on process creation telemetry including ParentImage, Image, and CommandLine to correlate the process tree and exported function string artifacts.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-qakbot-like-rundll32-exports-via-script-or-cmd-parent-339ed3d6
title: Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings
id: 8525c610-5cfe-4af5-8ffe-4edf530338d5
status: test
description: This rule identifies Windows process creation where rundll32.exe is launched by specific scripting/command interpreters and the command line contains Qakbot-associated ProgramData/Public/AppData/Temp paths. It further matches command-line endings tied to a set of export identifiers commonly used in Qakbot execution flows. The detection relies on process creation telemetry including ParentImage, Image, and CommandLine to correlate the process tree and exported function string artifacts.
references:
- https://github.com/pr0xylife/Qakbot/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
modified: 2023-05-30
tags:
- attack.execution
- detection.emerging-threats
- attack.stealth
logsource:
product: windows
category: process_creation
detection:
selection_paths:
ParentImage|endswith:
- \cmd.exe
- \cscript.exe
- \curl.exe
- \mshta.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
Image|endswith: \rundll32.exe
CommandLine|contains:
- :\ProgramData\
- :\Users\Public\
- \AppData\Local\Temp\
- \AppData\Roaming\
selection_exports:
CommandLine|endswith:
- aslr
- bind
- DrawThemeIcon
- GG10
- GL70
- jhbvygftr
- kjhbhkjvydrt
- LS88
- Motd
- N115
- next
- Nikn
- print
- qqqb
- qqqq
- RS32
- Test
- Time
- Updt
- vips
- Wind
- WW50
- X555
- XL55
- xlAutoOpen
- XS88
condition: all of selection_*
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: 339ed3d6-5490-46d0-96a7-8abe33078f58
type: derived