detection.wiki

Detection rules › Sigma

Kapeka Backdoor Persistence Activity

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Swachchhanda Shrawan Poudel
Source
github.com/SigmaHQ/sigma

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1053.005 Scheduled Task/Job: Scheduled Task
PersistenceT1053.005 Scheduled Task/Job: Scheduled Task
Privilege EscalationT1053.005 Scheduled Task/Job: Scheduled Task

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Kapeka Backdoor Persistence Activity
id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
status: test
description: |
    Detects Kapeka backdoor persistence activity.
    Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
    For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
    To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
    Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
    - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_schtasks_flags:
        CommandLine|contains|all:
            - 'create'
            - 'ONSTART'
    selection_reg_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_flags:
        CommandLine|contains|all:
            - 'add'
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
    selection_backdoor_command:
        CommandLine|contains|all:
            - 'rundll32'
            - '.wll'
            - '#1'
        CommandLine|contains:
            - 'Sens Api'
            - 'OneDrive' # The scheduled task was called "OneDrive" instead of "Sens Api" in some cases
    condition: (all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

(all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command

Stage 1: selection_schtasks_img

selection_schtasks_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: selection_schtasks_flags

selection_schtasks_flags:
    CommandLine|contains|all:
        - 'create'
        - 'ONSTART'

Stage 3: selection_reg_img

selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 4: selection_reg_flags

selection_reg_flags:
    CommandLine|contains|all:
        - 'add'
        - '\Software\Microsoft\Windows\CurrentVersion\Run'

Stage 5: selection_backdoor_command

selection_backdoor_command:
    CommandLine|contains|all:
        - 'rundll32'
        - '.wll'
        - '#1'
    CommandLine|contains:
        - 'Sens Api'
        - 'OneDrive'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • #1 corpus 2 (sigma 2)
  • .wll corpus 2 (sigma 2)
  • ONSTART corpus 2 (sigma 1, kusto 1)
  • OneDrive
  • Sens Api
  • \Software\Microsoft\Windows\CurrentVersion\Run corpus 3 (sigma 3)
  • add corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2)
  • create corpus 24 (sigma 17, splunk 7)
  • rundll32 corpus 26 (sigma 23, chronicle 2, kusto 1)
Imageends_with
  • \reg.exe corpus 58 (sigma 58)
  • \schtasks.exe corpus 56 (sigma 56)
OriginalFileNameeq
  • reg.exe corpus 42 (sigma 32, splunk 8, elastic 2)
  • schtasks.exe corpus 23 (sigma 18, splunk 4, elastic 1)