Qakbot

Welcome to the Qakbot challenge! In this challenge, you will step into the shoes of a seasoned threat hunter and incident responder. You have been hired by the renowned company SolidLabs to assist with investigating a string of Qakbot attacks.

SolidLabs, a global leader in technological innovation, has been grappling with an increasing number of attacks that have put their valuable assets and confidential information at risk. Their network defenses have detected a recurring pattern in these attacks, pointing towards the notorious Qakbot malware as the primary culprit.

Qakbot, also known as Qbot is a persistent strain of malware that has plagued organizations worldwide. It is notorious for its ability to stealthily infiltrate networks, establish a persistent presence, and exfiltrate sensitive data. SolidLabs does not possess the capabilities or expertise to investigate effectively and will rely on you to quickly and accurately scope the intrusion. You will also be asked to create detections that will uncover future attacks of the same nature.

The events in your SIEM can be found in the following timespan: 27 May 2023 - 4 June 2023.