Search and filter across all detection sources
10 rules
Attachment: Archive with pdf, txt and wsf files
Detects a known Qakbot delivery method, zip file with pdf, txt and wsf file at a depth of 1
Link to auto-downloaded file with Adobe branding
A link in the body of the email downloads a file from a site that uses Adobe branding as employed by threat actors, such as Qakbot.
Attachment: Double base64-encoded zip file in HTML smuggling attachment
Qakbot double Base64 encodes zip files within their HTML smuggling email attachments. This leads to predictable file header strings appearing in the HTML string content.
Link to auto-downloaded file with Google Drive branding
A link in the body of the email downloads a file from a site that uses Google Drive branding as employed by threat actors, such as Qakbot.
Attachment: PDF with suspicious language and redirect to suspicious file type
Attached PDF contains credential theft language, and links to an open redirect to a suspicious file type. This has been observed in-the-wild as a Qakbot technique.
PDF attachment with Google (AE) redirecting to a php or zip file
Detects a PDF attachment with a link that contains a Google.ae redirect URL.
Attachment: PDF with link to zip containing a wsf file
Detects a PDF attachment with a link to a ZIP file that contains a WSF file
Attachment: PDF file with low reputation link to ZIP file (unsolicited)
Detects messages with PDF attachments linking directly to zip files from unsolicited senders.
Link to auto-downloaded disk image in encrypted zip
A link in the body of the email downloads an encrypted zip that contains a disk image of the format IMG, ISO or VHD. This is a combination of file types used to deliver Qakbot.
Attachment: HTML smuggling with embedded base64 streamed file download
HTML attachments containing base64-encoded files that are downloaded via embedded hyperlinks. This TTP is used by attackers to bypass email and web filters since the file is not downloaded from an external source. Recently observed delivering Qakbot.