huntrule

Windows file drop indicator for Kapeka decrypted backdoor (.wll) in AppData/Common AppData

Alerts on suspicious Kapeka backdoor file drops in Windows AppData/Common AppData using .wll naming patterns.

FreeUnreviewedSigmahighv1
title: Windows file drop indicator for Kapeka decrypted backdoor (.wll) in AppData/Common AppData
id: ba096256-c199-49ab-8f7d-e5b28532db5d
status: test
description: This rule flags Windows file events where a suspicious backdoor payload is written to an AppData location and matches a deceptive .wll filename pattern. Attackers use this type of staged, disguised payload to maintain stealth by placing executables in common user data directories and mimicking legitimate-looking filenames. The detection relies on file event telemetry, specifically the TargetFilename containing ProgramData or AppData\Local paths and matching 5–6 alphabetic characters followed by a .wll extension, or ending with win32log.exe/crdss.exe.
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/file_event_win_malware_kapeka_backdoor_indicators.yml
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-03
tags:
  - detection.emerging-threats
  - attack.stealth
logsource:
  category: file_event
  product: windows
detection:
  selection_generic:
    TargetFilename|contains:
      - :\ProgramData\
      - \AppData\Local\
    TargetFilename|re: \\[a-zA-Z]{5,6}\.wll
  selection_specific:
    TargetFilename|endswith:
      - \win32log.exe
      - \crdss.exe
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 20228d05-dd68-435d-8b4e-e7e64938880c
    type: derived

What it detects

This rule flags Windows file events where a suspicious backdoor payload is written to an AppData location and matches a deceptive .wll filename pattern. Attackers use this type of staged, disguised payload to maintain stealth by placing executables in common user data directories and mimicking legitimate-looking filenames. The detection relies on file event telemetry, specifically the TargetFilename containing ProgramData or AppData\Local paths and matching 5–6 alphabetic characters followed by a .wll extension, or ending with win32log.exe/crdss.exe.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.