attack.t1553.003 | Detection.FYI

Kapeka Backdoor Configuration Persistence

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1553.003 ·
Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Read More
Persistence Via New SIP Provider

Aug 12, 2024 · attack.persistence attack.defense-evasion attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More