Potential KamiKakaBot Activity - Winlogon Shell Persistence

Status: test
Severity: high
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems), X__Junior
Source: github.com/SigmaHQ/sigma

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.

Known false positives

Unlikely

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Privilege Escalation	`T1547.001` Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential KamiKakaBot Activity - Winlogon Shell Persistence
id: c9b86500-1ec2-4de6-9120-d744c8fb5caf
status: test
description: |
    Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.
references:
    - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
author: Nasreddine Bencherchali (Nextron Systems), X__Junior
date: 2024-03-22
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1547.001
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|endswith: '\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'
        Details|contains|all:
            - '-nop -w h'
            - '$env'
            - 'explorer.exe'
            - 'Start-Process'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    TargetObject|endswith: '\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell'
    Details|contains|all:
        - '-nop -w h'
        - '$env'
        - 'explorer.exe'
        - 'Start-Process'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Details`	match	`$env` `-nop -w h` `Start-Process` `explorer.exe`	`field:"Details" kind:match`
`TargetObject`	ends_with	`\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell`	`field:"TargetObject" kind:ends_with value:"\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"`