Kapeka Backdoor Autorun Persistence

calendar Oct 23, 2025 · attack.privilege-escalation attack.persistence attack.t1547.001 detection.emerging-threats  ·
Share on: linkedin copy

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Sigma rule (View on GitHub)

 1title: Kapeka Backdoor Autorun Persistence
 2id: c0c67b21-eb8a-4c84-a395-40473ec3b482
 3related:
 4    - id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
 5      type: similar
 6status: test
 7description: Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.
 8references:
 9    - https://labs.withsecure.com/publications/kapeka
10    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
11author: Swachchhanda Shrawan Poudel
12date: 2024-07-03
13tags:
14    - attack.privilege-escalation
15    - attack.persistence
16    - attack.t1547.001
17    - detection.emerging-threats
18logsource:
19    category: registry_set
20    product: windows
21detection:
22    selection:
23        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
24        TargetObject|endswith:
25            - '\Sens Api'
26            - '\OneDrive'
27        Details|contains|all:
28            - ':\WINDOWS\system32\rundll32.exe'
29            - '.wll'
30            - '#1'
31    condition: selection
32falsepositives:
33    - Unknown
34level: high

References

  • Kapeka: A novel backdoor spotted in Eastern Europe

    This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection between Kapeka and Sandworm group. The purpose of this report is to raise awareness amongst businesses, governments, and the broader security community. WithSecure has engaged governments and select customers with advanced copies of this report. In addition to the report, we are releasing several artifacts developed as a result of our research, including a registry-based & hardcoded configuration extractor, a script to decrypt and emulate the backdoor’s network communication, and as might be expected, a list of indicators of compromise, YARA rules, and MITRE ATT&CK mapping


    Read More

  • ANY.RUN

    Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.


    Read More

Related rules

to-top