Windows Registry Seed Value Set Under Cryptography\Providers (Kapeka SIP Persistence)
Flags registry set operations creating/setting a "Seed" value under the Cryptography Providers key path on Windows.
- Product
- windows
- Category
- registry_set
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2024-07-03
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows registry set activity targeting a value named "Seed" within the Cryptography\Providers key path. It flags writes consistent with adding or altering SIP-related configuration for persistence, which attackers can use to maintain control across reboots. The detection relies on telemetry that records registry set events, including the full TargetObject and Details fields, and excludes entries marked as containing "(Empty)".
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Registry Seed Value Set Under Cryptography\Providers (Kapeka SIP Persistence)
id: 46bedf6b-cca5-43aa-92c4-0518f04de34c
status: test
description: This rule identifies Windows registry set activity targeting a value named "Seed" within the Cryptography\Providers key path. It flags writes consistent with adding or altering SIP-related configuration for persistence, which attackers can use to maintain control across reboots. The detection relies on telemetry that records registry set events, including the full TargetObject and Details fields, and excludes entries marked as containing "(Empty)".
references:
- https://labs.withsecure.com/publications/kapeka
- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_configuration.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
- attack.persistence
- attack.defense-impairment
- attack.t1553.003
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Cryptography\Providers\{
TargetObject|endswith: \Seed
filter_main_empty:
Details|contains: (Empty)
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd
type: derived