Kapeka Backdoor Scheduled Task Creation

SigmaHQ Detections@sigmaHQ

•updated May 20, 2025•0•25

Detects the creation of scheduled tasks by the Kapeka backdoor. This rule specifically looks for Event ID 4698 (A scheduled task was created) and then filters on specific content within the TaskContent field, including common Kapeka-related paths like ':\ProgramData\' or '\AppData\Local\', the presence of 'rundll32', '.wll', and '#1' in the command line, and task names such as 'OneDrive' or 'Sens Api'.