Sigma rule: Kapeka Backdoor Persistence Activity

Rule

Title

Kapeka Backdoor Persistence Activity

Status

test

Level

high

Author

Swachchhanda Shrawan Poudel

Date

2024-07-03

File

rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Kapeka backdoor persistence activity.
Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Log source

product

windows

category

process_creation

Detection

selection_schtasks_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'
selection_schtasks_flags:
    CommandLine|contains|all:
        - 'create'
        - 'ONSTART'
selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'
selection_reg_flags:
    CommandLine|contains|all:
        - 'add'
        - '\Software\Microsoft\Windows\CurrentVersion\Run'
selection_backdoor_command:
    CommandLine|contains|all:
        - 'rundll32'
        - '.wll'
        - '#1'
    CommandLine|contains:
        - 'Sens Api'
        - 'OneDrive' # The scheduled task was called "OneDrive" instead of "Sens Api" in some cases
condition: (all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command

False positives (as the rule lists them)

• Unlikely

Tags

• attack.privilege-escalation
• attack.execution
• attack.persistence
• attack.t1053.005
• detection.emerging-threats

MITRE ATT&CK ids this rule names

• T1053.005

References

• https://labs.withsecure.com/publications/kapeka
• https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
• https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2024/Malware/kapeka/proc_creation_win_malware_kapeka_backdoor_persistence.yml