huntrule

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

FreeReviewedSigma · Critical · v5
Product
windows
Category
process_creation
Author
X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-24
Updated
2026-07-31
AnalysisDetection
title: Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings
id: 8525c610-5cfe-4af5-8ffe-4edf530338d5
status: test
description: This rule identifies Windows process creation where rundll32.exe is launched by specific scripting/command interpreters and the command line contains Qakbot-associated ProgramData/Public/AppData/Temp paths. It further matches command-line endings tied to a set of export identifiers commonly used in Qakbot execution flows. The detection relies on process creation telemetry including ParentImage, Image, and CommandLine to correlate the process tree and exported function string artifacts.
references:
  - https://github.com/pr0xylife/Qakbot/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/Qakbot/proc_creation_win_malware_qakbot_rundll32_exports.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-05-24
modified: 2023-05-30
tags:
  - attack.execution
  - detection.emerging-threats
  - attack.stealth
logsource:
  product: windows
  category: process_creation
detection:
  selection_paths:
    ParentImage|endswith:
      - \cmd.exe
      - \cscript.exe
      - \curl.exe
      - \mshta.exe
      - \powershell.exe
      - \pwsh.exe
      - \wscript.exe
    Image|endswith: \rundll32.exe
    CommandLine|contains:
      - :\ProgramData\
      - :\Users\Public\
      - \AppData\Local\Temp\
      - \AppData\Roaming\
  selection_exports:
    CommandLine|endswith:
      - aslr
      - bind
      - DrawThemeIcon
      - GG10
      - GL70
      - jhbvygftr
      - kjhbhkjvydrt
      - LS88
      - Motd
      - N115
      - next
      - Nikn
      - print
      - qqqb
      - qqqq
      - RS32
      - Test
      - Time
      - Updt
      - vips
      - Wind
      - WW50
      - X555
      - XL55
      - xlAutoOpen
      - XS88
  condition: all of selection_*
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 339ed3d6-5490-46d0-96a7-8abe33078f58
    type: derived