Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
7
1
Contributors
7
1
Categories
3
2
2
1
1
Platforms
8
Products / Services
2
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects persistence mechanisms used by the Kapeka backdoor. It specifically looks for the creation of a scheduled task named "Sens Api" (or "OneDrive" in some cases) via `schtasks.exe` set to run on system startup, or the addition of an autorun registry entry named "Sens Api" under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` via `reg.exe`. Both persistence methods are identified by their command lines calling `rundll32` with a `.wll` file and the export ordinal `#1`.
Detects the setting of a new value in the Windows Registry Run key that is used by the Kapeka backdoor for persistence. Specifically, it looks for entries in `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` that end with `\Sens Api` or `\OneDrive` and contain `rundll32.exe`, `.wll`, and `#1` in their details, which are indicators of Kapeka's persistence mechanism.
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In. The rule specifically looks for rundll32.exe loading a DLL with a '.wll' extension from common user-writable directories like ProgramData or AppData\Local.
Detects the creation of scheduled tasks by the Kapeka backdoor. This rule specifically looks for Event ID 4698 (A scheduled task was created) and then filters on specific content within the TaskContent field, including common Kapeka-related paths like ':\ProgramData\' or '\AppData\Local\', the presence of 'rundll32', '.wll', and '#1' in the command line, and task names such as 'OneDrive' or 'Sens Api'.
This rule detects the creation of specific files associated with the Kapeka backdoor. It looks for files created in common application data directories (ProgramData or AppData\Local) that have a 5-6 character alphanumeric name followed by a ".wll" extension. Additionally, it specifically looks for files named "win32log.exe" or "crdss.exe" in these locations, which are known indicators of the Kapeka backdoor. The Kapeka dropper disguises these files as legitimate to evade detection.
Detects Kapeka backdoor process execution pattern, where the dropper launches the backdoor binary by calling rundll32.exe and passing the backdoor's first export ordinal (#1) with a "-d" argument. The rule specifically looks for rundll32.exe executing a .wll file from common temporary or application data directories like ProgramData or AppData\Local, combined with the ordinal #1 and a "-d" argument.
Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.