Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
status: test
description: |
    Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command.
    This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.
references:
    - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
    - https://tria.ge/240123-rapteaahhr/behavioral1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-03-22
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - ' /create '
            - 'shutdown /l /f'
            - 'WEEKLY'
    filter_main_system_user:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    Image|endswith: '\schtasks.exe'
    CommandLine|contains|all:
        - ' /create '
        - 'shutdown /l /f'
        - 'WEEKLY'

Stage 2: `not filter_main_system_user`

filter_main_system_user:
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`User`	match	`AUTHORI`	`excludes:User` `field:"User" value:"AUTHORI"`
`User`	match	`AUTORI`	`excludes:User` `field:"User" value:"AUTORI"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`/create` corpus 15 (sigma 15) `WEEKLY` `shutdown /l /f`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\schtasks.exe` corpus 55 (sigma 55)	`field:"Image" kind:ends_with value:"\schtasks.exe"`