title: Potential KamiKakaBot Activity - Shutdown Schedule Task Creation
id: fe9e8ba9-4419-41e6-a574-bd9f7b3af961
status: test
description: |
    Detects the creation of a schedule task that runs weekly and execute the "shutdown /l /f" command.
    This behavior was observed being used by KamiKakaBot samples in order to achieve persistence on a system.
references:
    - https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
    - https://tria.ge/240123-rapteaahhr/behavioral1
author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
date: 2024-03-22
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - ' /create '
            - 'shutdown /l /f'
            - 'WEEKLY'
    filter_main_system_user:
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium