Detection rules › Sigma

Kapeka Backdoor Configuration Persistence

Status
test
Severity
medium
Log source
product windows, category registry_set
Author
Swachchhanda Shrawan Poudel
Source
github.com/SigmaHQ/sigma

Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers" registry key. The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.

MITRE ATT&CK coverage

Event coverage

ProviderEventTitle
SysmonEvent ID 13RegistryEvent (Value Set)

Rule body yaml

title: Kapeka Backdoor Configuration Persistence
id: cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd
status: test
description: |
    Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key.
    The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1553.003
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Cryptography\Providers\{'
        TargetObject|endswith: '\Seed'
    filter_main_empty:
        Details|contains: '(Empty)'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\Cryptography\Providers\{'
    TargetObject|endswith: '\Seed'

Stage 2: not filter_main_empty

filter_main_empty:
    Details|contains: '(Empty)'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Detailsmatch(Empty)

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectends_with
  • \Seed
TargetObjectmatch
  • \SOFTWARE\Microsoft\Cryptography\Providers\{