Kapeka Backdoor Loaded Via Rundll32.EXE

Status: test
Severity: high
Log source: category image_load, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1204.002` User Execution: Malicious File
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 7: Image loaded

Rule body

title: Kapeka Backdoor Loaded Via Rundll32.EXE
id: a7e6b1f9-8d2c-4f1e-9a7d-63e4c8a2bf4c
status: test
description: |
    Detects the Kapeka Backdoor binary being loaded by rundll32.exe.
    The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.execution
    - attack.stealth
    - attack.t1204.002
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: image_load
    product: windows
detection:
    selection:
        Image|endswith: '\rundll32.exe'
        ImageLoaded|contains:
            - ':\ProgramData'
            - '\AppData\Local\'
        ImageLoaded|re: '[a-zA-Z]{5,6}\.wll'
    condition: selection
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '\rundll32.exe'
    ImageLoaded|contains:
        - ':\ProgramData'
        - '\AppData\Local\'
    ImageLoaded|re: '[a-zA-Z]{5,6}\.wll'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`ImageLoaded`	match	`:\ProgramData` `\AppData\Local\`	`field:"ImageLoaded" kind:match`
`ImageLoaded`	regex_match	`[a-zA-Z]{5,6}.wll`	`field:"ImageLoaded" kind:regex_match value:"[a-zA-Z]{5,6}.wll"`