{"id":"1c8e96cd-2bed-487d-9de0-b46c90cade56","title":"Potential Qakbot Registry Activity","description":"Detects a registry key used by IceID in a campaign that distributes malicious OneNote files","author":"Hieu Tran","status":"test","level":"high","date":"2023-03-13","modified":"","tags":["attack.persistence","attack.defense-impairment","attack.t1112"],"technique_ids":["T1112"],"logsource":{"category":"registry_event","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"source_path":"rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml","source_sha256":"5e3bd42da65966d2e3e0156bd4dbba5b80206b558e94cb567f5f2b2aa8ae4f5c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_malware_qakbot_registry.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Qakbot Registry Activity\nid: 1c8e96cd-2bed-487d-9de0-b46c90cade56\nstatus: test\ndescription: Detects a registry key used by IceID in a campaign that distributes malicious OneNote files\nreferences:\n    - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution\nauthor: Hieu Tran\ndate: 2023-03-13\ntags:\n    - attack.persistence\n    - attack.defense-impairment\n    - attack.t1112\nlogsource:\n    category: registry_event\n    product: windows\ndetection:\n    selection:\n        TargetObject|endswith: '\\Software\\firm\\soft\\Name'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1112","id":"T1112","name":"Modify Registry","page":"techniques/enterprise/T1112/"}],"data_path":"data/detection-rules/1c8e96cd-2bed-487d-9de0-b46c90cade56.json","kind":"sigma"}