Windows Registry Winlogon Shell Modification Using PowerShell-Like Values

Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.

FreeUnreviewedSigmahighv1

windows-registry-winlogon-shell-modification-using-powershell-like-values-c9b86500

title: Windows Registry Winlogon Shell Modification Using PowerShell-Like Values
id: 5ffe1adf-809f-4753-882a-dae8206acdb8
status: test
description: This rule identifies registry sets to the Winlogon Shell value containing indicators consistent with a persistence attempt that launches a PowerShell-style command (e.g., -nop -w h, $env, Start-Process) and still references explorer.exe. Attackers may use Winlogon Shell modification to start malicious processes at user logon while blending with normal shell behavior. The detection relies on Windows registry set telemetry, matching the specific Winlogon Shell target and the presence of these command fragments in the Details field.
references:
  - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2024/Malware/KamiKakaBot/registry_set_malware_kamikakabot_winlogon_persistence.yml
author: Nasreddine Bencherchali (Nextron Systems), X__Junior, Huntrule Team
date: 2024-03-22
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1547.001
  - detection.emerging-threats
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|endswith: \Microsoft\Windows NT\CurrentVersion\Winlogon\Shell
    Details|contains|all:
      - -nop -w h
      - $env
      - explorer.exe
      - Start-Process
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: c9b86500-1ec2-4de6-9120-d744c8fb5caf
    type: derived

What it detects

This rule identifies registry sets to the Winlogon Shell value containing indicators consistent with a persistence attempt that launches a PowerShell-style command (e.g., -nop -w h, $env, Start-Process) and still references explorer.exe. Attackers may use Winlogon Shell modification to start malicious processes at user logon while blending with normal shell behavior. The detection relies on Windows registry set telemetry, matching the specific Winlogon Shell target and the presence of these command fragments in the Details field.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.