Emerging Threatcriticaltest

SNAKE Malware Kernel Driver File Indicator

Detects SNAKE malware kernel driver file indicator

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Nasreddine Bencherchali (Nextron Systems)Created Wed May 10d6d9d23f-69c1-41b5-8305-fa8250bd027f2023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename: 'C:\Windows\System32\Com\Comadmin.dat'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Other

detection.emerging-threats

Rule Metadata

Rule ID

d6d9d23f-69c1-41b5-8305-fa8250bd027f

Status

test

Level

critical

Type

Emerging Threat

Created

Wed May 10

Author

Path

rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_encrypted_payload_ioc.yml

Raw Tags

attack.executiondetection.emerging-threats