huntrule

Windows Kapeka Backdoor Persistence via schtasks or Run Registry Key

Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.

FreeUnreviewedSigmahighv1
title: Windows Kapeka Backdoor Persistence via schtasks or Run Registry Key
id: 0e11030b-f4f2-4c29-adf2-43c84efdf735
status: test
description: This rule identifies Kapeka backdoor persistence attempts where execution is arranged through either a scheduled task (created with schtasks to run on system startup) or a Run registry entry. The attacker uses rundll32 to invoke the backdoor via a specific export ordinal (#1), and the persistence is associated with the task/entry name “Sens Api” (sometimes “OneDrive”). It relies on process creation telemetry capturing schtasks.exe or reg.exe command lines and the subsequent rundll32 invocation parameters containing the backdoor DLL (.wll) and “#1.”
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection_schtasks_img:
    - Image|endswith: \schtasks.exe
    - OriginalFileName: schtasks.exe
  selection_schtasks_flags:
    CommandLine|contains|all:
      - create
      - ONSTART
  selection_reg_img:
    - Image|endswith: \reg.exe
    - OriginalFileName: reg.exe
  selection_reg_flags:
    CommandLine|contains|all:
      - add
      - \Software\Microsoft\Windows\CurrentVersion\Run
  selection_backdoor_command:
    CommandLine|contains|all:
      - rundll32
      - .wll
      - "#1"
    CommandLine|contains:
      - Sens Api
      - OneDrive
  condition: (all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
    type: derived

What it detects

This rule identifies Kapeka backdoor persistence attempts where execution is arranged through either a scheduled task (created with schtasks to run on system startup) or a Run registry entry. The attacker uses rundll32 to invoke the backdoor via a specific export ordinal (#1), and the persistence is associated with the task/entry name “Sens Api” (sometimes “OneDrive”). It relies on process creation telemetry capturing schtasks.exe or reg.exe command lines and the subsequent rundll32 invocation parameters containing the backdoor DLL (.wll) and “#1.”

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.