huntrule

Windows Registry Seed Value Set Under Cryptography\Providers (Kapeka SIP Persistence)

Flags registry set operations creating/setting a "Seed" value under the Cryptography Providers key path on Windows.

FreeReviewedSigma · Medium · v5
Product
windows
Category
registry_set
Author
Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published
2024-07-03
Updated
2026-07-31
AnalysisDetection
title: Windows Registry Seed Value Set Under Cryptography\Providers (Kapeka SIP Persistence)
id: 46bedf6b-cca5-43aa-92c4-0518f04de34c
status: test
description: This rule identifies Windows registry set activity targeting a value named "Seed" within the Cryptography\Providers key path. It flags writes consistent with adding or altering SIP-related configuration for persistence, which attackers can use to maintain control across reboots. The detection relies on telemetry that records registry set events, including the full TargetObject and Details fields, and excludes entries marked as containing "(Empty)".
references:
  - https://labs.withsecure.com/publications/kapeka
  - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_configuration.yml
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2024-07-03
tags:
  - attack.persistence
  - attack.defense-impairment
  - attack.t1553.003
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Cryptography\Providers\{
    TargetObject|endswith: \Seed
  filter_main_empty:
    Details|contains: (Empty)
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd
    type: derived