detection.wiki

Detection rules › Sigma

Potential Kapeka Decrypted Backdoor Indicator

Status
test
Severity
high
Log source
product windows, category file_event
Author
Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges. The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.

MITRE ATT&CK coverage

TacticTechniques
StealthNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Potential Kapeka Decrypted Backdoor Indicator
id: 20228d05-dd68-435d-8b4e-e7e64938880c
status: test
description: |
    Detects the presence of a file that is decrypted backdoor binary dropped by the Kapeka Dropper, which disguises itself as a hidden file under a folder named "Microsoft" within "CSIDL_COMMON_APPDATA" or "CSIDL_LOCAL_APPDATA", depending on the process privileges.
    The file, typically 5-6 characters long with a random combination of consonants and vowels followed by a ".wll" extension to pose as a legitimate file to evade detection.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-03
tags:
    - detection.emerging-threats
    - attack.stealth
logsource:
    category: file_event
    product: windows
detection:
    selection_generic:
        TargetFilename|contains:
            - ':\ProgramData\'
            - '\AppData\Local\'
        TargetFilename|re: '\\[a-zA-Z]{5,6}\.wll'
    selection_specific:
        TargetFilename|endswith:
            - '\win32log.exe'
            - '\crdss.exe'
    condition: 1 of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

1 of selection_*

Stage 1: selection_generic

selection_generic:
    TargetFilename|contains:
        - ':\ProgramData\'
        - '\AppData\Local\'
    TargetFilename|re: '\\[a-zA-Z]{5,6}\.wll'

Stage 2: selection_specific

selection_specific:
    TargetFilename|endswith:
        - '\win32log.exe'
        - '\crdss.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • \crdss.exe
  • \win32log.exe
TargetFilenamematch
  • :\ProgramData\ corpus 4 (sigma 4)
  • \AppData\Local\ corpus 2 (sigma 2)
TargetFilenameregex_match
  • \[a-zA-Z]{5,6}.wll