Kapeka Backdoor Registry Run Key Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

Detects the setting of a new value in the Windows Registry Run key that is used by the Kapeka backdoor for persistence. Specifically, it looks for entries in `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` that end with `\Sens Api` or `\OneDrive` and contain `rundll32.exe`, `.wll`, and `#1` in their details, which are indicators of Kapeka's persistence mechanism.