Potential KamiKakaBot Activity - Winlogon Shell Persistence — Detection Rule
Detects changes to the "Winlogon" registry key where a process will set the value of the "Shell" to a value that was observed being used by KamiKakaBot samples in order to achieve persistence.