attack.t1553.003 | Detection.FYI

Kapeka Backdoor Configuration Persistence

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1553.003 detection.emerging-threats ·
Share on:

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

Read More
Persistence Via New SIP Provider

Apr 28, 2026 · attack.persistence attack.defense-impairment attack.t1553.003 ·
Share on:

Detects when an attacker register a new SIP provider for persistence and defense evasion

Read More