Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Flags rundll32.exe loading a suspicious .wll backdoor from ProgramData or AppData\Local.

FreeReviewedSigma · High · v5

Product: windows
Category: image_load
Author: Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published: 2024-07-03
Updated: 2026-07-31

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1204.002Malicious File
Persistence
Priv Esc
Defense Evasion
- T1218.011Rundll32
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies rundll32.exe loading a DLL with a .wll extension from user or program data locations. The behavior aligns with a loader that deploys a backdoor DLL masquerading as a legitimate Word add-in to evade attention. It relies on image load telemetry that provides the process image name and the loaded module path.

Reporting behind it

Related detections9 linkedT1204.002 — drag to rearrange

Malicious rundll32 Execution of COLDCOPY DLL via COLDRIVER ClickFix

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious NFe-Themed Brazilian Lure Executable Execution

Malicious Zardoor Backdoor Execution via rundll32 (via process_creation)

Suspicious Executable Dropped in Public Users Directory Named Ctrlpanel (via file_event)

Suspicious Interlock Fake Updater Executable Execution

Malicious Office Application Loading a User-Path DLL via Regsvr32 or Rundll32 (via process_creation)

Suspicious Program Execution From a Mounted ISO or Disk Image (via process_creation)

Malicious Rundll32 Loading an Export From a User Path (via process_creation)

Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe

Pivot detection · T1204.002 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-kapeka-backdoor-loaded-via-rundll32-exe-a7e6b1f9

title: "Windows: Kapeka backdoor DLL (.wll) loaded via rundll32.exe"
id: 592b394b-0a7a-4c6a-be08-2122d471eb9f
status: test
description: This rule identifies rundll32.exe loading a DLL with a .wll extension from user or program data locations. The behavior aligns with a loader that deploys a backdoor DLL masquerading as a legitimate Word add-in to evade attention. It relies on image load telemetry that provides the process image name and the loaded module path.
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/image_load_malware_kapeka_backdoor_wll.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.execution
  - attack.stealth
  - attack.t1204.002
  - attack.t1218.011
  - detection.emerging-threats
logsource:
  category: image_load
  product: windows
detection:
  selection:
    Image|endswith: \rundll32.exe
    ImageLoaded|contains:
      - :\ProgramData
      - \AppData\Local\
    ImageLoaded|re: "[a-zA-Z]{5,6}\\.wll"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL