qakbot-campaign-outlook

id: 221ba640-3727-4b48-b30c-f5bb7398be7b
name: qakbot-campaign-outlook
description: |
  This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
  Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
  The following query detects attempts to access files in the local path that contain Outlook emails.
  Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Discovery
query: |
  DeviceFileEvents
  | where FolderPath hasprefix "EmailStorage"
  | where FolderPath has "Outlook"
  | project FileName, FolderPath, InitiatingProcessFileName,
  InitiatingProcessCommandLine, DeviceId, Timestamp