Emerging Threatlowtest

SNAKE Malware Installer Name Indicators

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed May 1099eccc2b-7182-442f-8806-b76cc36d866b2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith:
            - '\jpsetup.exe'
            - '\jpinst.exe'
    condition: selection

False Positives

Some legitimate software was also seen using these names. Apply additional filters and use this rule as a hunting basis.

References

MITRE ATT&CK

Tactics

Other

detection.emerging-threats

Rule Metadata

Rule ID

99eccc2b-7182-442f-8806-b76cc36d866b

Status

test

Level

low

Type

Emerging Threat

Created

Wed May 10

Author

Path

rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_installers_ioc.yml

Raw Tags

attack.executiondetection.emerging-threats