Potential KamiKakaBot Activity - Lure Document Execution via CMD

SigmaHQ Detections@sigmaHQ

•updated Feb 3, 2025•1•0•19

Detects the execution of a Word document via the WinWord Start Menu shortcut using `cmd.exe`. This behavior has been observed in KamiKakaBot samples to initiate the second stage of infection. The rule specifically looks for `cmd.exe` executing a command line that includes a `.lnk` file, a path containing `Start Menu\Programs\Word`, and a `.doc` file extension.