Potential KamiKakaBot Activity - Winlogon Shell Persistence

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

Detects changes to the "Winlogon" registry key where a process sets the "Shell" value to a string containing specific PowerShell commands observed in KamiKakaBot samples. This technique is used to achieve persistence by executing a malicious script during user logon.