Windows file drop: Kapeka-style decrypted backdoor indicators in AppData with .wll naming
Alerts on suspicious Kapeka backdoor file drops in Windows AppData/Common AppData using .wll naming patterns.
- Product
- windows
- Category
- file_event
- Author
- Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2024-07-03
- Updated
- 2026-07-31
What it detects
This rule flags Windows file events where a suspicious file name matches a Kapeka-style decrypted backdoor drop pattern: a 5–6 character alphabetic string followed by the .wll extension located under ProgramData or AppData\Local. It also matches specific disguised filenames ending with win32log.exe or crdss.exe. These behaviors matter because attackers often evade discovery by placing decrypted payloads in user- or common-application data directories with misleading file names; the detection relies on file path and filename patterns from file event telemetry.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows file drop: Kapeka-style decrypted backdoor indicators in AppData with .wll naming"
id: ba096256-c199-49ab-8f7d-e5b28532db5d
status: test
description: "This rule flags Windows file events where a suspicious file name matches a Kapeka-style decrypted backdoor drop pattern: a 5–6 character alphabetic string followed by the .wll extension located under ProgramData or AppData\\Local. It also matches specific disguised filenames ending with win32log.exe or crdss.exe. These behaviors matter because attackers often evade discovery by placing decrypted payloads in user- or common-application data directories with misleading file names; the detection relies on file path and filename patterns from file event telemetry."
references:
- https://labs.withsecure.com/publications/kapeka
- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/file_event_win_malware_kapeka_backdoor_indicators.yml
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2024-07-03
tags:
- detection.emerging-threats
- attack.stealth
logsource:
category: file_event
product: windows
detection:
selection_generic:
TargetFilename|contains:
- :\ProgramData\
- \AppData\Local\
TargetFilename|re: \\[a-zA-Z]{5,6}\.wll
selection_specific:
TargetFilename|endswith:
- \win32log.exe
- \crdss.exe
condition: 1 of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 20228d05-dd68-435d-8b4e-e7e64938880c
type: derived