hightestEmerging Threat
Potential SNAKE Malware Installation Binary Indicator
Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report
windowsprocess_creation
2023-05-04
Rule Library
Sigma Rules
Browse detections by severity and log source, with YAML and sample events one click away.
3,782Total
3,164Detection
474Emerging
141Hunting
hightestEmerging Threat
Potential SNAKE Malware Persistence Service Execution
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.
windowsprocess_creation
2023-05-04
hightestEmerging Threat
SNAKE Malware Covert Store Registry Key
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA
windowsregistry_event
2023-05-11
mediumtestEmerging Threat
Potential Encrypted Registry Blob Related To SNAKE Malware
Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA
windowsregistry_set
2023-08-17
criticaltestEmerging Threat
SNAKE Malware Service Persistence
Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report
windowssystem
2023-05-10