Kapeka Backdoor Persistence Activity

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel
Source: github.com/SigmaHQ/sigma

Detects Kapeka backdoor persistence activity. Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not). For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM. To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command. Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1053.005` Scheduled Task/Job: Scheduled Task
Persistence	`T1053.005` Scheduled Task/Job: Scheduled Task
Privilege Escalation	`T1053.005` Scheduled Task/Job: Scheduled Task

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Kapeka Backdoor Persistence Activity
id: 64a871dd-83f6-4e5f-80fc-5a7ca3a8a819
status: test
description: |
    Detects Kapeka backdoor persistence activity.
    Depending on the process privileges, the Kapeka dropper then sets persistence for the backdoor either as a scheduled task (if admin or SYSTEM) or autorun registry (if not).
    For the scheduled task, it creates a scheduled task called "Sens Api" via schtasks command, which is set to run upon system startup as SYSTEM.
    To establish persistence through the autorun utility, it adds an autorun entry called "Sens Api" under HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run via the "reg add" command.
    Both persistence mechanisms are set to launch the binary by calling rundll32 and passing the backdoor's first export ordinal (#1) without any additional argument.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
    - https://www.virustotal.com/gui/file/bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f/behavior
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.privilege-escalation
    - attack.execution
    - attack.persistence
    - attack.t1053.005
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks_img:
        - Image|endswith: '\schtasks.exe'
        - OriginalFileName: 'schtasks.exe'
    selection_schtasks_flags:
        CommandLine|contains|all:
            - 'create'
            - 'ONSTART'
    selection_reg_img:
        - Image|endswith: '\reg.exe'
        - OriginalFileName: 'reg.exe'
    selection_reg_flags:
        CommandLine|contains|all:
            - 'add'
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
    selection_backdoor_command:
        CommandLine|contains|all:
            - 'rundll32'
            - '.wll'
            - '#1'
        CommandLine|contains:
            - 'Sens Api'
            - 'OneDrive' # The scheduled task was called "OneDrive" instead of "Sens Api" in some cases
    condition: (all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

(all of selection_schtasks_* or all of selection_reg_*) and selection_backdoor_command

Stage 1: `selection_schtasks_img`

selection_schtasks_img:
    - Image|endswith: '\schtasks.exe'
    - OriginalFileName: 'schtasks.exe'

Stage 2: `selection_schtasks_flags`

selection_schtasks_flags:
    CommandLine|contains|all:
        - 'create'
        - 'ONSTART'

Stage 3: `selection_reg_img`

selection_reg_img:
    - Image|endswith: '\reg.exe'
    - OriginalFileName: 'reg.exe'

Stage 4: `selection_reg_flags`

selection_reg_flags:
    CommandLine|contains|all:
        - 'add'
        - '\Software\Microsoft\Windows\CurrentVersion\Run'

Stage 5: `selection_backdoor_command`

selection_backdoor_command:
    CommandLine|contains|all:
        - 'rundll32'
        - '.wll'
        - '#1'
    CommandLine|contains:
        - 'Sens Api'
        - 'OneDrive'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`#1` corpus 2 (sigma 2) `.wll` corpus 2 (sigma 2) `ONSTART` corpus 2 (sigma 1, kusto 1) `OneDrive` `Sens Api` `\Software\Microsoft\Windows\CurrentVersion\Run` corpus 3 (sigma 3) `add` corpus 34 (sigma 26, splunk 4, chronicle 2, kusto 2) `create` corpus 29 (sigma 17, splunk 7, elastic 5) `rundll32` corpus 26 (sigma 23, chronicle 2, kusto 1)	`field:"CommandLine" kind:match`
`Image`	ends_with	`\reg.exe` corpus 58 (sigma 58) `\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`reg.exe` corpus 43 (sigma 32, splunk 8, elastic 3) `schtasks.exe` corpus 31 (sigma 18, elastic 9, splunk 4)	`field:"OriginalFileName" kind:eq`

Kapeka Backdoor Persistence Activity

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_schtasks_img

Stage 2: selection_schtasks_flags

Stage 3: selection_reg_img

Stage 4: selection_reg_flags