Qakbot Rundll32 Fake DLL Extension Execution

SIGMA detection rule by X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · GPL-2.0

Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.

title: Qakbot Rundll32 Fake DLL Extension Execution
id: 28b6ad8c-6543-08dc-cc45-4088c5d03882
related:
    - id: bfd34392-c591-4009-b938-9fd985a28b85
      type: derived
status: test
description: Detects specific process tree behavior of a "rundll32" execution where the DLL doesn't have the ".dll" extension. This is often linked with potential Qakbot activity.
references:
    - https://github.com/pr0xylife/Qakbot/
author: X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-24
tags:
    - attack.execution
    - detection.emerging-threats
    - attack.stealth
logsource:
    product: windows
    category: process_creation
detection:
    process_creation:
        EventID: 4688
        Channel: Security
    selection:
        CommandLine|contains:
            # Note: Only add paths seen used by Qakbot to avoid collision with other strains of malware
            - :\ProgramData\
            - :\Users\Public\
            - \AppData\Local\Temp\
            - \AppData\Roaming\
        ParentProcessName|endswith:
            # Note: Only add processes seen used by Qakbot to avoid collision with other strains of malware
            - \cmd.exe
            - \cscript.exe
            - \curl.exe
            - \mshta.exe
            - \powershell.exe
            - \pwsh.exe
            - \wscript.exe
        NewProcessName|endswith: \rundll32.exe
    filter_main_extension:
        CommandLine|contains: .dll
    condition: process_creation and (selection and not 1 of filter_main_*)
falsepositives:
    - Unlikely
level: critical
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

08cf7b93-c926-4b2f-b7d1-d0d2e5d7cac4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion