Browse detections by severity and log source, with YAML and sample events one click away.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. This filename was reported to be related to the Moriya rootkit as described in the securelist's Operation TunnelSnake report.
Detects SNAKE malware kernel driver file indicator
Detects filename indicators associated with the SNAKE malware as reported by CISA in their report
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity
Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report