Kapeka Backdoor Execution Via RunDLL32.EXE
Detects Kapeka backdoor process execution pattern, where the dropper launches the backdoor binary by calling rundll32.exe and passing the backdoor's first export ordinal (#1) with a "-d" argument. The rule specifically looks for rundll32.exe executing a .wll file from common temporary or application data directories like ProgramData or AppData\Local, combined with the ordinal #1 and a "-d" argument.
Sigma
