huntrule

Windows Kapeka backdoor loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

FreeUnreviewedSigmahighv1
title: Windows Kapeka backdoor loaded via rundll32.exe
id: 592b394b-0a7a-4c6a-be08-2122d471eb9f
status: test
description: This rule identifies rundll32.exe loading a Kapeka backdoor DLL located under ProgramData or AppData\Local. The backdoor appears as a .wll module with a 5–6 letter filename, supporting stealth through masquerading as a Microsoft Word add-in. It relies on image-load telemetry that records both the loader process image path and the loaded module path.
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/image_load_malware_kapeka_backdoor_wll.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.002
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    ImageLoaded|contains:
      - :\ProgramData
      - \AppData\Local\
    ImageLoaded|re: "[a-zA-Z]{5,6}\\.wll"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
    type: derived

What it detects

This rule identifies rundll32.exe loading a Kapeka backdoor DLL located under ProgramData or AppData\Local. The backdoor appears as a .wll module with a 5–6 letter filename, supporting stealth through masquerading as a Microsoft Word add-in. It relies on image-load telemetry that records both the loader process image path and the loaded module path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.