Kapeka Backdoor Loaded Via Rundll32.EXE
Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In. The rule specifically looks for rundll32.exe loading a DLL with a '.wll' extension from common user-writable directories like ProgramData or AppData\Local.
Sigma
