Kapeka Backdoor Autorun Registry Persistence on Windows Run Keys

title: Kapeka Backdoor Autorun Registry Persistence on Windows Run Keys
id: b33ac50b-f7a5-4321-8903-c0a6bfccdff6
related:
  - id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
    type: similar
  - id: c0c67b21-eb8a-4c84-a395-40473ec3b482
    type: derived
status: test
description: "This rule matches new or modified registry values under the Windows Run auto-start location that target entries used by the Kapeka backdoor. Attackers commonly use Run keys for persistence so their payload executes automatically at user logon. The detection relies on Windows registry set telemetry, specifically the TargetObject path and the Details content indicating a rundll32 command with the expected .wll and #1 markers."
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    TargetObject|endswith:
      - \Sens Api
      - \OneDrive
    Details|contains|all:
      - :\WINDOWS\system32\rundll32.exe
      - .wll
      - "#1"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1