qakbot-campaign-registry-edit

id: 3f305589-cde2-4509-8204-63cb2a00117c
name: qakbot-campaign-registry-edit
description: |
  This query was originally published in the threat analytics report, Qakbot blight lingers, seeds ransomware
  Qakbot is malware that steals login credentials from banking and financial services. It has been deployed against small businesses as well as major corporations. Some outbreaks have involved targeted ransomware campaigns that use a similar set of techniques. Links to related queries are listed under See also.
  The following query detects registry entries that may indicate that an operator is trying to establish persistence for the Qakbot binary.
  Reference - https://www.microsoft.com/security/blog/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceRegistryEvents
tactics:
- Persistence
query: |
  DeviceRegistryEvents
  | where ActionType == "RegistryValueSet"
  | where InitiatingProcessFileName == "explorer.exe"
  | where RegistryValueData has @"AppData\Roaming\Microsoft" and
  RegistryValueData has "$windowsupdate"
  | where RegistryKey has @"CurrentVersion\Run"
  | project RegistryKey, RegistryValueData, DeviceId, Timestamp