Threat Research

Detects modifications to the "Winlogon" registry key, where the "Shell" value is set to a value associated with KamiKakaBot samples to establish persistence....

Detects the execution of a Word document through the WinWord Start Menu shortcut. This technique has been observed in KamiKakaBot samples to trigger the second stage of infection....

Detects the creation of a scheduled task configured to run weekly and executes the "shutdown /l /f" command. This behavior has been observed in KamiKakaBot samples as a method to maintain persistence on a system....