Qbot ESA Rule

esa_rule

/*
Version: 2
*/

@Name('Module_QbotCampaign_Alert')
@Description('Current Qbot campaigns attempt to download a supposed PNG file with a filename consisting of between 4-8 numeric characters that is actually an EXE. This is a good post infection IoC.')

@RSAAlert(oneInSeconds=0)
SELECT * FROM
Event
(
service=80
AND
filename REGEXP '[0-9]{4,8}\.png'
AND
filetype='windows executable'
);