Emerging Threathightest
Potential SNAKE Malware Installation CLI Arguments Indicator
Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Emerging Threat
Active Threat
Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic1 selector
detection:
selection:
# This CLI regex is based on the following description from the report:
# The jpsetup.exe installer requires two arguments to be passed via the command line for execution
# The first argument is a wide character string hashed with SHA-256 twice -> We assume that the first argument is of length SHA256
# The AES initialization vector (IV) consists of the first 16 bytes of the second argument to jpsetup.exe -> We assume that the second argument is of at least 16 bytes (16 characters)
CommandLine|re: '\s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}'
condition: selectionFalse Positives
Unlikely
False positives are unlikely for most environments. High confidence detection.
References
MITRE ATT&CK
Tactics
Other
detection.emerging-threats
Rule Metadata
Rule ID
02cbc035-b390-49fe-a9ff-3bb402c826db
Status
test
Level
high
Type
Emerging Threat
Created
Thu May 04
Path
rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml
Raw Tags
attack.executiondetection.emerging-threats