Kapeka Backdoor Execution Via RunDLL32.EXE

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218.011` System Binary Proxy Execution: Rundll32

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Kapeka Backdoor Execution Via RunDLL32.EXE
id: e98f741c-6a5b-4c83-bc2a-1f4e58d07b12
status: test
description: |
    Detects Kapeka backdoor process execution pattern, where the dropper launch the backdoor binary by calling rundll32 and passing the backdoor's first export ordinal (#1) with a "-d" argument.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
date: 2024-07-03
tags:
    - attack.stealth
    - attack.t1218.011
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\rundll32.exe'
        - OriginalFileName: 'RUNDLL32.EXE'
    selection_backdoor_path:
        CommandLine|contains:
            - ':\ProgramData'
            - '\AppData\Local'
    selection_backdoor_exec_1:
        CommandLine|contains|all:
            - '.wll'
            - '#1'
            - ' -d'
    selection_backdoor_exec_2:
        # This account for the in the wild variant
        CommandLine|contains: '.wll'
        CommandLine|endswith: '#1'
    condition: selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: `condition`

selection_img and selection_backdoor_path and 1 of selection_backdoor_exec_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\rundll32.exe'
    - OriginalFileName: 'RUNDLL32.EXE'

Stage 2: `selection_backdoor_path`

selection_backdoor_path:
    CommandLine|contains:
        - ':\ProgramData'
        - '\AppData\Local'

Stage 3: `selection_backdoor_exec_1`

selection_backdoor_exec_1:
    CommandLine|contains|all:
        - '.wll'
        - '#1'
        - ' -d'

Stage 4: `selection_backdoor_exec_2`

selection_backdoor_exec_2:
    CommandLine|contains: '.wll'
    CommandLine|endswith: '#1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	ends_with	`#1`	`field:"CommandLine" kind:ends_with value:"#1"`
`CommandLine`	match	`-d` corpus 4 (sigma 2, elastic 2) `#1` corpus 2 (sigma 2) `.wll` corpus 2 (sigma 2) `:\ProgramData` corpus 2 (sigma 2) `\AppData\Local`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\rundll32.exe` corpus 94 (sigma 94)	`field:"Image" kind:ends_with value:"\rundll32.exe"`
`OriginalFileName`	eq	`RUNDLL32.EXE` corpus 78 (sigma 35, elastic 22, splunk 21)	`field:"OriginalFileName" kind:eq value:"RUNDLL32.EXE"`

Kapeka Backdoor Execution Via RunDLL32.EXE

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_backdoor_path