Potential KamiKakaBot Activity - Winlogon Shell Persistence

Rule Info

Name
Potential KamiKakaBot Activity - Winlogon Shell Persistence
Author
Nasreddine Bencherchali (Nextron Systems), X__Junior
Description
Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.
Date
2024-03-22 00:00:00
Modified
None
Id
c9b86500-1ec2-4de6-9120-d744c8fb5caf
Tags
attack.persistence attack.t1547.001 detection.emerging-threats DEMO
Type
Community Rule

Rule History

Author
Title
Date
Commit
Nasreddine Bencherchali
Merge PR #4950 from @nasbench - Comply With v2 Spec Changes
2024-08-12
Nasreddine Bencherchali
Merge PR #4781 from @nasbench - KamiKakaBot Malware Related Rules
2024-03-25