SNAKE is tracked here as a malware family or toolset with 9 Sigma detections spanning 2023. Coverage centers on windows / file_event, windows / process_creation, windows / registry_event +2.
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA
Detects filename indicators associated with the SNAKE malware as reported by CISA in their report
Detects SNAKE malware kernel driver file indicator