Using Wazuh to Detect and Respond to BQTLock Ransomware
Summary
A Wazuh guide shows how to detect BQTLock activity on Windows using Sysmon, custom rules and hash lists, then configure Active Response to remove detected files.
Key points
- The guide describes BQTLock as Windows-targeting ransomware that uses hybrid AES-256 and RSA-4096 encryption and appends .BQTLOCK to encrypted files.
- Behaviors covered include creating a privileged BQTLockAdmin account and scheduled task, staging files in Windows Temp, and disabling recovery options.
- It shows how to forward Sysmon events to Wazuh and create rules for suspicious accounts, commands, ransom notes, scheduled tasks and encrypted-file extensions.
- A Wazuh CDB list of SHA-256 hashes, combined with File Integrity Monitoring, is used to alert on known BQTLock files in monitored directories.
- The guide configures Wazuh Active Response to run a Windows script that removes a detected file and logs whether remediation succeeded.
Article Details
- Defense Focus
- Detect BQTLock activity on Windows endpoints and automatically remove detected ransomware files using Wazuh.
- Detection Methods
- Forward Sysmon operational events to Wazuh and use custom rules to alert on BQTLock account creation, staging files, recovery-inhibition commands, ransom notes, encrypted-file extensions, scheduled tasks, and cleanup commands.
- Use Wazuh File Integrity Monitoring to compare file SHA-256 values against a CDB list of known BQTLock hashes.
- Monitor users' Downloads folders in real time for file creation or modification and review matching alerts in the Wazuh dashboard.
- Data Sources
- Windows Sysmon operational event-channel logs, including process command lines and file events.
- Wazuh File Integrity Monitoring events and file SHA-256 checksums.
- Wazuh Active Response logs reporting remediation success or failure.
- Rule Types
- Custom Wazuh XML detection rules for Windows events and BQTLock file or command patterns.
- Wazuh CDB-list SHA-256 match rule.
- Wazuh Active Response command and rule-ID trigger configuration.
- Platforms
- Windows endpoints
- Wazuh server and dashboard
- Defensive Actions
- Configure Sysmon and forward its operational event channel to Wazuh.
- Deploy the BQTLock-specific detection rules and reload the Wazuh ruleset.
- Populate a Wazuh CDB list with the supplied BQTLock hashes and configure File Integrity Monitoring for relevant directories.
- Use the documented Active Response configuration to remove files whose hashes match the BQTLock list, and review success or failure alerts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 00005ed250d85fc47e4c3883b8e6179a9888b8140acfeb94a40edc36bd523adb | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 008ec0226066572f4b27f100d08443120b9dd55cefbec2bbff994b5b552e546c | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 0ccd3f2d7e6637eaf5414e35b97d9d8bf6b8e4182859cace8ca8e02377a4e62a | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 10938c2d01dc999d2fe1f8c635e3705e7e663077935a17e730c849d1191c76ed | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 11affbeb18f4d6edcc9a4be5a82f8e23dfc31178887e97119faa5ddc75990494 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 2aae1d749353067f5afb5bebedb5249047f60e7aaa9684ac7c779a0908b1573c | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 324eabc27a25f524c94bb62573986b3335ab5181ddc6825d959d16aaaccdc7aa | Identified as a BQTLock sample hash and included in the Wazuh CDB list. |
| SHA256 | 3857744a651da4e431083180798041a5e888b09334a1a04c2c047216f471b0f6 | Identified as a BQTLock sample hash and included in the Wazuh CDB list. |
| SHA256 | 425b2f283b71237276f84d941d9c2982c7f61a9aff12ece10e15065b73b7165e | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 4369aed581de0fe84c25a1ef2c3cf0bb6bf70df8b51fdf38b3b0b2a55f43261b | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 4525387f28bee6bb48d07e6989319f382447a8a6e48ae11f332dee9916feb8cc | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 56eec59a5fe3f5a3c2c836701557bf1956770f465cd9e049995b86aef76a3e39 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 590e47944ef0597bf1ff1d41656859b776e7031a4611cbf22d619002cbe49312 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 5b992a3438e344dddcdd66151a40efb3452b2ff37cdc40b37db612afeb29ed29 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 5ffa525fead0b2d81d8bbfa0630aebee5f0b2d3f4ab583e92ac41e6c8f814661 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 67a315a0fe8d466f71716a83ab0e745ec4a7fa2e210a1b06e3396b516f554554 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 780e34c72404fd464669626ae554b81393d2bae95293284b375bb5d989914486 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 9547933dd46501af7fc095a3513e48b81178e344b86e075b679259875f0fd5a7 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 9600db537e27db88ed2eca3be0ffab35cdb22a86a6dbb048d8deaf8f56944822 | Identified as a BQTLock sample hash and included in the Wazuh CDB list. |
| SHA256 | 97524f4c582e0fbe46b74a7cfe4db9f078f368520cda25f27a50c5d2c50161f9 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | 9cd62dbace3324487124787127cff7c63a9f005d8d3aff9bac28c437e5caefc7 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | a6a397fec6c109a1402c6f1144d647843b2093f65fedd27204b40ebeea0640b6 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | af90666822646e35eb52248f4a89eb715ce9f44459205bc24827a2aafe053548 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | b211537ea626fae4ad2ef5ee2652633dc68aaf20da6eb953a44f266c4106b367 | Identified as a BQTLock sample hash and included in the Wazuh CDB list. |
| SHA256 | b61ae633616d7dd29aaf0b170fdfbe8f282c0f8bdcb1c52aedee473ce4bf5789 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | b7796a3b1812f329c43d5d37bbb6d8032b7bc06b15af29f555eb3e0c7b1b1c3d | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | cd5e7b3b59cea14b804f6c01821d1ab94a0046422fe956f623b238c5db0cac99 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | dacbba7f18d0835deb2eeb4e4d82c8f57234767291a90da1a5f3fd02d6bc13c2 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | e2622ede1ebe5a37c439a32f0c63c13f893d1e5513b27367502898651cc5464b | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
| SHA256 | fbd67a3bcc964e370931f620a85bf368d7b5797ebc1d53fe3be11a89a90e7961 | Listed in the Wazuh CDB list as a known BQTLock ransomware hash. |
MITRE ATT&CK
T1053.005 · Scheduled TaskBQTLock is reported to create a scheduled task that runs at user logon with the highest privileges.T1059 · Command and Scripting InterpreterThe article reports BQTLock executing command-line operations, including recovery-inhibition and delayed file-deletion commands.T1070.004 · File DeletionThe article reports a delayed command chain that deletes an executable artifact after execution.T1136 · Create AccountBQTLock is reported to create the privileged account BQTLockAdmin.T1486 · Data Encrypted for ImpactBQTLock encrypts files and appends the .BQTLOCK extension.T1490 · Inhibit System RecoveryBQTLock is reported to delete Volume Shadow Copies and use bcdedit commands to disable or alter recovery options.