Kapeka Backdoor Scheduled Task Creation
Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.
Sigma rule (View on GitHub)
1title: Kapeka Backdoor Scheduled Task Creation
2id: 6c130acd-0adb-4545-bcc4-2e85d0883c9a
3related:
4 - id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
5 type: similar
6status: test
7description: Detects Kapeka backdoor scheduled task creation based on attributes such as paths, commands line flags, etc.
8references:
9 - https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4698
10 - https://labs.withsecure.com/publications/kapeka
11 - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
12 - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
13author: Swachchhanda Shrawan Poudel
14date: 2024-07-03
15tags:
16 - attack.execution
17 - attack.privilege-escalation
18 - attack.persistence
19 - attack.t1053.005
20 - detection.emerging-threats
21logsource:
22 product: windows
23 service: security
24 definition: 'Requirements: The Advanced Audit Policy setting Object Access > Audit Other Object Access Events has to be configured to trigger this detection.'
25detection:
26 selection_eid:
27 EventID: 4698
28 selection_paths:
29 TaskContent|contains:
30 - ':\ProgramData\'
31 - '\AppData\Local\'
32 selection_command:
33 TaskContent|contains|all:
34 - 'rundll32'
35 - '.wll'
36 - '#1'
37 selection_taskname:
38 TaskContent|contains:
39 - 'OneDrive' # The scheduled task was called “OneDrive” instead of “Sens Api” in some cases
40 - 'Sens Api'
41 condition: all of selection_*
42falsepositives:
43 - Unknown
44level: high
References
-
Describes security event 4698(S) A scheduled task was created. This event is generated when a scheduled task is created.
Read More -
This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection between Kapeka and Sandworm group. The purpose of this report is to raise awareness amongst businesses, governments, and the broader security community. WithSecure has engaged governments and select customers with advanced copies of this report. In addition to the report, we are releasing several artifacts developed as a result of our research, including a registry-based & hardcoded configuration extractor, a script to decrypt and emulate the backdoor’s network communication, and as might be expected, a list of indicators of compromise, YARA rules, and MITRE ATT&CK mapping
Read More -
Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
Read More -
Related rules
- Diamond Sleet APT Scheduled Task Creation
- ChromeLoader Malware Execution
- Serpent Backdoor Payload Execution Via Scheduled Task
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- Important Scheduled Task Deleted/Disabled