Potential Kapeka Decrypted Backdoor Indicator
This rule detects the creation of specific files associated with the Kapeka backdoor. It looks for files created in common application data directories (ProgramData or AppData\Local) that have a 5-6 character alphanumeric name followed by a ".wll" extension. Additionally, it specifically looks for files named "win32log.exe" or "crdss.exe" in these locations, which are known indicators of the Kapeka backdoor. The Kapeka dropper disguises these files as legitimate to evade detection.
Sigma
