Sigma rule: Potential SNAKE Malware Installation CLI Arguments Indicator

Rule

Title

Potential SNAKE Malware Installation CLI Arguments Indicator

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2023-05-04

File

rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Log source

product

windows

category

process_creation

Detection

selection:
    # This CLI regex is based on the following description from the report:
    #   The jpsetup.exe installer requires two arguments to be passed via the command line for execution
    #   The first argument is a wide character string hashed with SHA-256 twice -> We assume that the first argument is of length SHA256
    #   The AES initialization vector (IV) consists of the first 16 bytes of the second argument to jpsetup.exe -> We assume that the second argument is of at least 16 bytes (16 characters)
    CommandLine|re: '\s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}'
condition: selection

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• detection.emerging-threats

References

• https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml