Kapeka Backdoor Execution Via RunDLL32.EXE

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

Sigma rule (View on GitHub)

 1title: Kapeka Backdoor Execution Via RunDLL32.EXE
 2id: e98f741c-6a5b-4c83-bc2a-1f4e58d07b12
 3status: experimental
 4description: |
 5        Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.
 6references:
 7    - https://labs.withsecure.com/publications/kapeka
 8    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
 9author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
10date: 2024-07-03
11tags:
12    - attack.defense-evasion
13    - attack.t1218.011
14logsource:
15    category: process_creation
16    product: windows
17detection:
18    selection_img:
19        - Image|endswith: '\rundll32.exe'
20        - OriginalFileName: 'RUNDLL32.EXE'
21    selection_backdoor_path:
22        CommandLine|contains:
23            - ':\ProgramData'
24            - '\AppData\Local'
25    selection_backdoor_exec_1:
26        CommandLine|contains|all:
27            - '.wll'
28            - '#1'
29            - ' -d'
30    selection_backdoor_exec_2:
31        # This account for the in the wild variant
32        CommandLine|contains: '.wll'
33        CommandLine|endswith: '#1'
34    condition: selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*
35falsepositives:
36    - Unknown
37level: high

References

Related rules

to-top