Potential KamiKakaBot Activity - Winlogon Shell Persistence
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Registry value modified" AND (OBJECTNAME endswith "\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell" OR (OBJECTNAME endswith "\Microsoft\Windows NT\CurrentVersion\Winlogon" AND OBJECTVALUENAME = "Shell")) AND (INFORMATION contains "-nop -w h" AND INFORMATION contains "$env" AND INFORMATION contains "explorer.exe" AND INFORMATION contains "Start-Process") select Action1.HOSTNAME,Action1.MESSAGE,Action1.OBJECTNAME,Action1.PROCESSNAME,Action1.PREVVAL,Action1.CHANGES
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Nasreddine Bencherchali (Nextron Systems), X__Junior
