Defend against malicious software with MaaS360 and QRadar

In today's rapidly evolving cybersecurity landscape, organizations struggle to maintain control over unauthorized software installations across their managed devices. These unauthorized applications not only pose compliance risks, but also introduce potential security vulnerabilities, increasing the likelihood of cyber threats.

Traditional security tools often operate in isolation, making it difficult to establish a seamless workflow for real-time detection and automated remediation. IBM QRadar Security Information and Event Management (SIEM) platform, in combination with MaaS360, presents a unified approach to tackling these challenges. In this article, you’ll learn how to integrate these technologies and strengthen your organization’s security posture, enforce compliance policies, and automate the removal of malicious software from your managed endpoints.

Component technologies

By integrating QRadar and MaaS360, you’ll leverage multiple technologies to provide a comprehensive security framework:

IBM MaaS360

IBM MaaS360 is a unified endpoint management solution that transforms how IT secures laptops, desktops, smartphones, tablets, frontline devices, while ensuring a great user experience. MaaS360 protects devices, apps, content and data with built-in endpoint security so you can build a strong security posture and keep a low TCO. Its built-in AI provides contextual analytics to give you actionable insights. Unified endpoint management (UEM) is the evolution of Client Management Tools, Mobile Device Management, and Enterprise Mobility Management. It enables clients to manage all types of devices from a single screen.

IBM MaaS360 focuses on three major use cases:

Unified endpoint management: MaaS360 provides best in class UEM/modern management coverage across all endpoints, enables co-existence with traditional endpoints management tools for laptop and desktop management and integrates and complements third-party platforms such as MS Ecosystem.
Frontline device management: MaaS360 manages specialized devices used by frontline workers to help them do their job anywhere (for example, manufacturing plants, oil platforms, or in the field). Devices include GMS, non-GMS, purpose-built, ruggedized, IoT, kiosks, AR/VR, and scanners, built on platforms such as Samsung, Honeywell, or Zebra.
Built-in endpoint security: MaaS360 expands security detection, prevention and response on mobile endpoints, provides security analytics to enable responses based on user and device risk posture and enable zero trust and XDR use cases through integrations with the IBM Security stack

IBM QRadar

IBM Security QRadar is a security information and event management (SIEM) solution, orchestrating prioritized alerts through the correlation of analytics, threat intelligence, and anomalies in network and user behavior. This enables you to concentrate on investigating and mitigating threats. QRadar gives you the ability to:

Detect targeted threats with real-time, prioritized alerts.
Integrate network detection and response (NDR) to monitor network flows tied to event or log data.
Leverage over 700 integrations to detect and respond to threats.
Implement 1,500 out-of-the-box use cases aligned with MITRE ATT&CK to identify and correlate activities across the kill chain with end-to-end visibility.
Use an automated query builder with smart property detection to search and pinpoint valuable data without writing rules or code.

Organizations lack a unified approach to monitoring and mitigating unauthorized software installations. Simply blocking execution is insufficient, as unauthorized software may still introduce vulnerabilities or be misused by insider threats.

Security teams require an integrated solution that:

Detects unauthorized software in real time.
Correlates policy violations with broader security insights.
Automates remediation by uninstalling non-compliant applications.
Reduces manual intervention and alert fatigue for security analysts.

Workflow: Defending against malicious software using QRadar and MaaS360

Following are the high-level steps to protect your organization against malicious software using QRadar and MaaS360. Note that this is a workflow rather than a step-by-step tutorial. For detailed instructions on individual screens, fields, and functions of QRadar and MaaS360, see the QRadar and MaaS360 product documentation sets.

Step 1: Configure an advanced compliance policy in MaaS360

In the MaaS360 policy settings, click Security > Policies.
Define an Advanced App Compliance Policy to restrict unauthorized software access by specifying the details provided in the screenshot (as an example).
Apply this policy to enrolled Windows machines.

Step 2: Set up log forwarding from Windows to QRadar

On the Windows 10 client, install and configure the WinCollect agent to forward logs to QRadar SIEM.
In Windows Event Viewer, create a custom view for AppLocker logs.
Configure WinCollect to forward these logs to QRadar SIEM.

Step 3: Configure a Windows log source in QRadar

In QRadar, add a Windows log source to receive AppLocker violation logs.
Verify that logs from WinCollect are being ingested and parsed properly in QRadar’s Event Viewer.
Create a custom property to map the Filename field from the raw events, which will then be used as input for the Custom Action Script.

Step 4: Create a custom rule in QRadar to detect unauthorized software access.

On a Windows machine, attempt to open a blocked application. This action generates an AppLocker event, which is forwarded to QRadar.
On the QRadar console, click the Offense tab and go to the Rules section.
Create a new rule in QRadar to detect the unauthorized software access attempt.
Click Next and define the Rule Actions and Rule Response. For Rule Response:
1. Add the detected malicious software to a QRadar Reference Set for future tracking.
2. Configure email notifications to alert security teams when an offense is triggered.
3. Run a Custom Action Script (Instructions on defining it are provided here)
Click Next and Finish. QRadar will trigger an offense when the custom detection rule identifies the policy violation.

Step 5: Configure QRadar custom action script

In the QRadar console, click Admin and in the Custom Actions section, click Define Actions.
In the window, click Add and upload your respective script.
Define the Fixed Property and Dynamic Property variables, which need to be fetched from the Network events in the next section.
click Save.
Navigate back to Admin Tab and in the Deploy Changes section, Click Deploy Changes.

Workflow diagram

Sample code

Note: The following script has been verified to work reliably on QRadar v7.5.0 Update Package 9 and later.

Ensure that all required Python libraries for the script are placed under the following directory (if the /lib directory does not exist, you must create it):

/opt/qradar/bin/ca_jail/home/customactionuser/lib/

Set the appropriate permissions for this directory:

chown customactionuser:root /opt/qradar/bin/ca_jail/home/customactionuser/lib/

For any files you copy into this directory, apply the following recursive permission change:

chown -R customactionuser:root <path_to_copied_files>/

To ensure the script can locate these library files during execution, be sure to include the following lines at the start of the script:

import sys
sys.path.append("/home/customactionuser/lib")

Sample code as follows:

import os
import sys
sys.path.append("/home/customactionuser/lib")
import winrm

#Retrieve environment variables
remote_host = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
application = sys.argv[4]
psexec_path = "<specify the path for psexec>"

if not all([remote_host, username, password, application]):
    print("Error: One or more environment variables are missing.")
    exit(1)

# PowerShell script to get the UninstallString from multiple registry paths
list_apps_ps = f"""
$ProgressPreference = 'SilentlyContinue'
$uninstallString = (
    Get-ItemProperty HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* -ErrorAction SilentlyContinue |
    Where-Object {{ $_.DisplayName -like '*{application}*' }} |
    Select-Object -ExpandProperty UninstallString
) -join "`n"

if (-not $uninstallString) {{
    $uninstallString = (
        Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* -ErrorAction SilentlyContinue |
        Where-Object {{ $_.DisplayName -like '*{application}*' }} |
        Select-Object -ExpandProperty UninstallString
    ) -join "`n"
}}

if (-not $uninstallString) {{
    $uninstallString = (
        Get-ItemProperty HKLM:\\Software\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* -ErrorAction SilentlyContinue |
        Where-Object {{ $_.DisplayName -like '*{application}*' }} |
        Select-Object -ExpandProperty UninstallString
    ) -join "`n"
}}

$uninstallString
"""
def run_powershell_command(command):
    try:
        session = winrm.Session(remote_host, auth=(username, password), transport='ntlm')
        result = session.run_ps(command)

        stdout = result.std_out.decode('utf-8', errors='ignore').strip()
        stderr = result.std_err.decode('utf-8', errors='ignore').strip()

        if result.status_code != 0:
            print(f"PowerShell execution failed with status code {result.status_code}")

        return stdout, stderr

    except Exception as e:
        return "", f"Exception occurred: {str(e)}"

# Execute PowerShell command to get uninstall string
uninstall_string, error = run_powershell_command(list_apps_ps)

if error:
    print(f"Error fetching uninstall string: {error}")
    exit(1)

if not uninstall_string:
    print(f"No uninstall string found for {application}.")
    exit(1)

print(f"Uninstall String for {application}:\n{uninstall_string}")

# Function to split uninstall string at first occurrence of '--' or '/'
def split_uninstall_string(uninstall_string):
    if '--' in uninstall_string:
        return uninstall_string.split('--', 1)
    elif '/' in uninstall_string:
        return uninstall_string.split('/', 1)
    else:
        return [uninstall_string, ""]

# Process the uninstall string
uninstall_string = uninstall_string.strip().replace('"', '')

uninstall_parts = split_uninstall_string(uninstall_string.strip())

if uninstall_parts[1]:  # If arguments are present
    #formatted_uninstall_command = f'Start-Process -FilePath "{uninstall_parts[0].strip()}" -ArgumentList "--{uninstall_parts[1].strip()}" "/SILENT" -NoNewWindow -Wait'
    formatted_uninstall_command = f"""
{psexec_path} -accepteula -s powershell.exe -Command "Start-Process -FilePath '{uninstall_parts[0].strip()}' -ArgumentList '--{uninstall_parts[1].strip()}', '/VERYSILENT', '/SUPPRESSMSGBOXES', '/NORESTART' -NoNewWindow -Wait"
"""
else:  # If no arguments are present
    #formatted_uninstall_command = f'Start-Process -FilePath "{uninstall_parts[0].strip()}" -ArgumentList  "/SILENT" -NoNewWindow -Wait'
    formatted_uninstall_command = f"""
{psexec_path} -accepteula -s powershell.exe -Command "Start-Process -FilePath '{uninstall_parts[0].strip()}' -ArgumentList '/VERYSILENT /SUPPRESSMSGBOXES /NORESTART' -NoNewWindow -Wait"
"""
print(f"\nAttempting to uninstall {application}...")
print(formatted_uninstall_command)
output, error = run_powershell_command(formatted_uninstall_command)

if error:
    print(f"Error during uninstallation: {error}")
else:
    print("Uninstallation process completed successfully!")

Demo video

Following is a demo of how you can implement a proactive defense against malicious software using MaaS360 and QRadar:

Summary

By integrating QRadar with MaaS360, organizations can enhance endpoint security by automatically detecting and removing unauthorized applications. This unified approach significantly reduces the attack surface, improves compliance, and optimizes security operations by minimizing manual intervention. The combination of real-time event correlation, automated remediation, and proactive security enforcement ensures that security teams can focus on critical threats rather than repetitive policy violations.

Next steps

Now that you know how to set up and use IBM Security MaaS360 and QRadar SIEM to detect unauthorized software execution, continue exploring IBM Security's capabilities and best practices for developers.

IBM Developer: Security hub (tutorials, articles, and other resources)
IBM Security MaaS360 (product page)
IBM MaaS360 Mobile Device Management (documentation)
IBM QRadar SIEM (product page)

Products

Languages

Technologies

Events

External Resources