huntrule

Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows

Flags registry changes to Winlogon Shell that include PowerShell-style startup and explorer.exe indicators.

FreeReviewedSigma · High · v5
Product
windows
Category
registry_set
Author
Nasreddine Bencherchali (Nextron Systems), X__Junior (SigmaHQ), DRL 1.1
Published
2024-03-22
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Priv Esc

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies registry value writes targeting the Winlogon Shell setting where the data contains specific process-spawn indicators: '-nop -w h', '$env', 'explorer.exe', and 'Start-Process'. Attackers often use Winlogon Shell persistence to ensure their payload launches at user logon, blending into normal startup behavior. The detection relies on Windows registry set telemetry that includes the registry path (TargetObject) and the written value (Details).

Reporting behind it

Related detections9 linkedT1547.001 — drag to rearrange
Suspicious Startup Folder LNK Persistence Creation via File System (via file_event)
Suspicious XWorm Persistence Run Key Pointing to Batch Loader via ScreenConnect Lure (via registry_set)
Suspicious Run Key Persistence Named AppResolver (via registry_set)
Suspicious SystemBC Persistence via Run Key to ProgramData Script
Suspicious Interlock RAT Persistence via HKCU Run Key Registration to AppData Payload (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Suspicious Run Key Persistence Referencing PowerShell Script via registry_set
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Persistence via Windows Update Service Run Key (via registry_set)
Winlogon Shell Registry Persistence Attempt (KamiKakaBot Indicators) on Windows
Pivot detection · T1547.001 · 9 related

Changelog

v5
  1. v5
    Candidate ingested via manual entry.2026-07-31
  2. v4
    Candidate ingested via manual entry.2026-07-31
  3. v3
    Candidate ingested via manual entry.2026-07-31
  4. v2
    Candidate ingested via manual entry.2026-07-31
  5. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.