← Back to SOC feed Coverage →

Qakbot email theft (1)

kql MEDIUM Azure-Sentinel
DeviceFileEvents
backdoorhuntingmicrosoftofficial
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Azure-Sentinel →
Retrieved: 2026-05-05T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries are leveraging Qakbot to steal email credentials by exfiltrating sensitive data from compromised mailboxes. SOC teams should proactively hunt for this behavior in Azure Sentinel to detect and mitigate early-stage email theft campaigns before data is exfiltrated.

KQL Query

DeviceFileEvents
| where InitiatingProcessFileName =~ 'ping.exe' and InitiatingProcessCommandLine == 'ping.exe -t 127.0.0.1'
    and InitiatingProcessParentFileName in~('msra.exe', 'mobsync.exe') and FolderPath endswith ".eml"

Analytic Rule Definition

id: a5c3ebdf-e427-4b1b-985e-c1f1e20067b7
name: Qakbot email theft (1)
description: |
  Use this query to find email stealing activities ran by Qakbot that will use "ping.exe -t 127.0.0.1" to obfuscate subsequent actions.
  Email theft that occurs might be exfiltrated to operators and indicates that the malware completed a large portion of its automated activity without interruption.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceFileEvents
tactics:
- Collection
query: |
  DeviceFileEvents
  | where InitiatingProcessFileName =~ 'ping.exe' and InitiatingProcessCommandLine == 'ping.exe -t 127.0.0.1'
      and InitiatingProcessParentFileName in~('msra.exe', 'mobsync.exe') and FolderPath endswith ".eml"

Required Data Sources

Sentinel TableNotes
DeviceFileEventsEnsure this data connector is enabled

MITRE ATT&CK Context

References

False Positive Guidance

Original source: https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Campaigns/Qakbot/Qakbot email theft (1).yaml