Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

FreeReviewedSigma · High · v5

Product: windows
Category: image_load
Author: Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published: 2024-07-03
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1218.011Rundll32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies rundll32.exe loading a DLL with a .wll extension from user or program data locations. The behavior aligns with a loader that deploys a backdoor DLL masquerading as a legitimate Word add-in to evade attention. It relies on image load telemetry that provides the process image name and the loaded module path.

Reporting behind it

Related detections9 linkedT1218.011 — drag to rearrange

Malicious Lunar Spider Loader Execution via rundll32 (via process_creation)

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

Malicious SYSTEM Persistence via Scheduled Task Running rundll32 at Startup (via process_creation)

Malicious Rundll32 Executing Image File as DLL

Suspicious Scheduled Task Executing Rundll32 DLL Export by Ordinal

Malicious Renamed Rundll32 Copied to Temp via Xcopy

Suspicious HijackLoader Component Execution via ClearFake

Suspicious rundll32 Executing DLL from ProgramData (via process_creation)

Malicious Silent AteraAgent RMM Installation via IntegratorLogin

Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Pivot detection · T1218.011 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-kapeka-backdoor-loaded-via-rundll32-exe-a7e6b1f9

title: "Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe"
id: 592b394b-0a7a-4c6a-be08-2122d471eb9f
status: test
description: This rule identifies rundll32.exe loading a DLL with a .wll extension from user or program data locations. The behavior aligns with a loader that deploys a backdoor DLL masquerading as a legitimate Word add-in to evade attention. It relies on image load telemetry that provides the process image name and the loaded module path.
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/image_load_malware_kapeka_backdoor_wll.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.002
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    ImageLoaded|contains:
      - :\ProgramData
      - \AppData\Local\
    ImageLoaded|re: "[a-zA-Z]{5,6}\\.wll"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL