Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun
Flags Windows persistence creation for Kapeka using schtasks (ONSTART) or Run registry entries plus rundll32 ordinal-based execution.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2024-07-03
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Kapeka backdoor persistence attempts that create a startup persistence mechanism using either schtasks (ONSTART) or a Run registry autorun. It looks for process creation of schtasks.exe with creation flags for ONSTART and/or reg.exe adding an entry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. In both cases, it requires a rundll32 command referencing .wll with export ordinal #1 and the value name that includes "Sens Api" (or "OneDrive" in some cases), indicating the backdoor payload is launched on startup.
Reporting behind it
- labs.withsecure.comhttps://labs.withsecure.com/publications/kapeka
- app.any.runhttps://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
- virustotal.comhttps://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Kapeka Backdoor Persistence via schtasks ONSTART or Run Registry Autorun
id: 0e11030b-f4f2-4c29-adf2-43c84efdf735
status: test
description: 'This rule matches Kapeka backdoor persistence attempts that create a startup persistence mechanism using either schtasks (ONSTART) or a Run registry autorun. It looks for process creation of schtasks.exe with creation flags for ONSTART and/or reg.exe adding an entry under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. In both cases, it requires a rundll32 command referencing .wll with export ordinal #1 and the value name that includes "Sens Api" (or "OneDrive" in some cases), indicating the backdoor payload is launched on startup.'
references:
- https://labs.withsecure.com/publications/kapeka
- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
- https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1053.005
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection_schtasks_img:
- Image|endswith: \schtasks.exe
- OriginalFileName: schtasks.exe
selection_schtasks_flags:
CommandLine|contains|all:
- create
- ONSTART
selection_reg_img:
- Image|endswith: \reg.exe
- OriginalFileName: reg.exe
selection_reg_flags:
CommandLine|contains|all:
- add
- \Software\Microsoft\Windows\CurrentVersion\Run
selection_backdoor_command:
CommandLine|contains|all:
- rundll32
- .wll
- "#1"
CommandLine|contains:
- Sens Api
- OneDrive
condition: (all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
type: derived