Qakbot reconnaissance activities

id: 2faad0ef-63f4-40aa-98e8-b713d9a8b3f7
name: Qakbot reconnaissance activities
description: |
  Use this query to find reconnaissance and beaconing activities after code injection occurs.
  Reconnaissance commands are consistent with the current version of Qakbot and occur automatically to exfiltrate system information. This data, once exfiltrated, will be used to prioritize human operated actions.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Discovery
query: |
  DeviceProcessEvents
  | where InitiatingProcessFileName == InitiatingProcessCommandLine
  | where ProcessCommandLine has_any (
  "whoami /all","cmd /c set","arp -a","ipconfig /all","net view /all","nslookup -querytype=ALL -timeout=10",
  "net share","route print","netstat -nao","net localgroup")
  | summarize dcount(FileName), make_set(ProcessCommandLine) by DeviceId,bin(Timestamp, 1d), InitiatingProcessFileName, InitiatingProcessCommandLine
  | where dcount_FileName >= 8