KamiKakaBot

Potential KamiKakaBot Activity - Lure Document Execution

Aug 12, 2024 · attack.execution attack.t1059 detection.emerging-threats ·

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

Potential KamiKakaBot Activity - Shutdown Schedule Task Creation

Aug 12, 2024 · attack.persistence detection.emerging-threats ·

Share on:

Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command. This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.

Potential KamiKakaBot Activity - Winlogon Shell Persistence

Aug 12, 2024 · attack.persistence attack.t1547.001 detection.emerging-threats ·

Share on:

Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.