Kapeka Backdoor Execution Via RunDLL32.EXE
Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.
Sigma rule (View on GitHub)
1title: Kapeka Backdoor Execution Via RunDLL32.EXE
2id: e98f741c-6a5b-4c83-bc2a-1f4e58d07b12
3status: experimental
4description: |
5 Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.
6references:
7 - https://labs.withsecure.com/publications/kapeka
8 - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
9author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
10date: 2024-07-03
11tags:
12 - attack.defense-evasion
13 - attack.t1218.011
14logsource:
15 category: process_creation
16 product: windows
17detection:
18 selection_img:
19 - Image|endswith: '\rundll32.exe'
20 - OriginalFileName: 'RUNDLL32.EXE'
21 selection_backdoor_path:
22 CommandLine|contains:
23 - ':\ProgramData'
24 - '\AppData\Local'
25 selection_backdoor_exec_1:
26 CommandLine|contains|all:
27 - '.wll'
28 - '#1'
29 - ' -d'
30 selection_backdoor_exec_2:
31 # This account for the in the wild variant
32 CommandLine|contains: '.wll'
33 CommandLine|endswith: '#1'
34 condition: selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*
35falsepositives:
36 - Unknown
37level: high
References
Related rules
- APT29 2018 Phishing Campaign CommandLine Indicators
- APT29 2018 Phishing Campaign File Indicators
- CobaltStrike Load by Rundll32
- Code Execution via Pcwutl.dll
- Equation Group DLL_U Export Function Load