Emerging Threathightest

Kapeka Backdoor Autorun Persistence

Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Swachchhanda Shrawan PoudelCreated Wed Jul 03c0c67b21-eb8a-4c84-a395-40473ec3b4822024

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsRegistry Set

ProductWindows← raw: windows

CategoryRegistry Set← raw: registry_set

Detection Logic

detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
        TargetObject|endswith:
            - '\Sens Api'
            - '\OneDrive'
        Details|contains|all:
            - ':\WINDOWS\system32\rundll32.exe'
            - '.wll'
            - '#1'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0004 · Privilege Escalation TA0003 · Persistence

Sub-techniques

T1547.001 · Registry Run Keys / Startup Folder

Other

detection.emerging-threats

Related Rules

SimilarEmerging Threathigh

Kapeka Backdoor Persistence Activity

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

c0c67b21-eb8a-4c84-a395-40473ec3b482

Status

test

Level

high

Type

Emerging Threat

Created

Wed Jul 03

Author

Swachchhanda Shrawan Poudel

Path

rules-emerging-threats/2024/Malware/kapeka/registry_set_malware_kapeka_backdoor_autorun_persistence.yml

Raw Tags

attack.privilege-escalationattack.persistenceattack.t1547.001detection.emerging-threats

View on GitHub