huntrule

Kapeka Backdoor Scheduled Task Creation on Windows (Security Event 4698)

Flags suspicious Kapeka-like scheduled task creation via Event 4698 using TaskContent paths, rundll32/.wll command markers, and OneDrive/Sens Api task names.

FreeUnreviewedSigmahighv1
title: Kapeka Backdoor Scheduled Task Creation on Windows (Security Event 4698)
id: 0c6ec1ff-12ba-4d7b-ba14-952719000e82
related:
  - id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
    type: similar
  - id: 6c130acd-0adb-4545-bcc4-2e85d0883c9a
    type: derived
status: test
description: This rule flags Windows Security Event ID 4698 when a scheduled task is created with Kapeka-like characteristics in the TaskContent. It looks for suspicious paths under ProgramData and AppData\Local, specific rundll32 usage with a .wll payload indicator, and task names containing OneDrive or Sens Api. This matters because scheduled tasks are a common persistence mechanism attackers use to execute backdoor components. The detection relies on Windows Security auditing that records scheduled task creation details in Event 4698 TaskContent.
references:
  - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/win_security_malware_kapeka_backdoor_scheduled_task_creation.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.execution
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1053.005
  - detection.emerging-threats
logsource:
  product: windows
  service: security
  definition: "Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to trigger this detection."
detection:
  selection_eid:
    EventID: 4698
  selection_paths:
    TaskContent|contains:
      - :\ProgramData\
      - \AppData\Local\
  selection_command:
    TaskContent|contains|all:
      - rundll32
      - .wll
      - "#1"
  selection_taskname:
    TaskContent|contains:
      - OneDrive
      - Sens Api
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule flags Windows Security Event ID 4698 when a scheduled task is created with Kapeka-like characteristics in the TaskContent. It looks for suspicious paths under ProgramData and AppData\Local, specific rundll32 usage with a .wll payload indicator, and task names containing OneDrive or Sens Api. This matters because scheduled tasks are a common persistence mechanism attackers use to execute backdoor components. The detection relies on Windows Security auditing that records scheduled task creation details in Event 4698 TaskContent.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.