Kapeka backdoor execution via rundll32.exe with ordinal export #1 and -d argument (Windows)

title: "Kapeka backdoor execution via rundll32.exe with ordinal export #1 and -d argument (Windows)"
id: 9ce22e86-4c93-46a6-b3a7-848ada87c538
status: test
description: This rule identifies a Kapeka backdoor launch pattern where rundll32.exe is used to execute a backdoor DLL-like payload residing in ProgramData or AppData Local. The command line includes the first export ordinal (#1) and a "-d" argument, which helps distinguish this execution technique from generic rundll32 usage. It relies on Windows process creation telemetry, matching Image or OriginalFileName for rundll32.exe and specific substrings in the command line indicating the payload location and ordinal invocation.
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_rundll32_execution.yml
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-03
tags:
  - attack.stealth
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \rundll32.exe
    - OriginalFileName: RUNDLL32.EXE
  selection_backdoor_path:
    CommandLine|contains:
      - :\ProgramData
      - \AppData\Local
  selection_backdoor_exec_1:
    CommandLine|contains|all:
      - .wll
      - "#1"
      - " -d"
  selection_backdoor_exec_2:
    CommandLine|contains: .wll
    CommandLine|endswith: "#1"
  condition: selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: e98f741c-6a5b-4c83-bc2a-1f4e58d07b12
    type: derived