Kapeka Backdoor Configuration Persistence

title: Kapeka Backdoor Configuration Persistence
id: cbaa3ef3-07a9-4c8e-82d1-9e40578da7fd
status: test
description: |
    Detects registry set activity of a value called "Seed" stored in the "\Cryptography\Providers\" registry key.
    The Kapeka backdoor leverages this location to register a new SIP provider for backdoor configuration persistence.
references:
    - https://labs.withsecure.com/publications/kapeka
    - https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
author: Swachchhanda Shrawan Poudel
date: 2024-07-03
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1553.003
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Microsoft\Cryptography\Providers\{'
        TargetObject|endswith: '\Seed'
    filter_main_empty:
        Details|contains: '(Empty)'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium