Windows File Indicator: SNAKE Malware Kernel Driver Target File Comadmin.dat
Alerts on Windows file events involving C:\Windows\System32\Com\Comadmin.dat, an indicator tied to SNAKE kernel driver activity.
FreeReviewedSigma · Critical · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-10
- Updated
- 2026-07-31
What it detects
This rule matches Windows file events where the target filename is exactly C:\Windows\System32\Com\Comadmin.dat. The presence or creation of this specific file path can indicate installation or staging activity associated with SNAKE malware components. It relies on file event telemetry that includes the target filename field for Windows.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-create-write-indicator-for-snake-kernel-driver-comadmin-dat-d6d9d23f
title: "Windows File Indicator: SNAKE Malware Kernel Driver Target File Comadmin.dat"
id: d7b77d75-c53d-4e53-9ca3-d761c0ef5b62
status: test
description: This rule matches Windows file events where the target filename is exactly C:\Windows\System32\Com\Comadmin.dat. The presence or creation of this specific file path can indicate installation or staging activity associated with SNAKE malware components. It relies on file event telemetry that includes the target filename field for Windows.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_encrypted_payload_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename: C:\Windows\System32\Com\Comadmin.dat
condition: selection
falsepositives:
- Unlikely
level: critical
license: DRL-1.1
related:
- id: d6d9d23f-69c1-41b5-8305-fa8250bd027f
type: derived