Windows File Events: SNAKE Malware Installer Filename Indicators

Flags Windows file events with target filenames ending in common SNAKE installer indicators like jpsetup.exe and jpinst.exe.

FreeUnreviewedSigmalowv1

windows-file-events-snake-malware-installer-filename-indicators-99eccc2b

title: "Windows File Events: SNAKE Malware Installer Filename Indicators"
id: b57db4bd-1cde-426f-bd29-653be04f43ca
status: test
description: This rule flags Windows file creation or access events where the target filename ends with installer-related names used in SNAKE malware reporting. Attackers commonly stage or drop installer executables to establish persistence or deliver payloads, so these filename indicators can reveal suspicious installer activity. The detection relies on file event telemetry with target filename values containing those specific suffixes.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_installers_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - \jpsetup.exe
      - \jpinst.exe
  condition: selection
falsepositives:
  - Some legitimate software was also seen using these names. Apply additional filters and use this rule as a hunting basis.
level: low
license: DRL-1.1
related:
  - id: 99eccc2b-7182-442f-8806-b76cc36d866b
    type: derived

What it detects

This rule flags Windows file creation or access events where the target filename ends with installer-related names used in SNAKE malware reporting. Attackers commonly stage or drop installer executables to establish persistence or deliver payloads, so these filename indicators can reveal suspicious installer activity. The detection relies on file event telemetry with target filename values containing those specific suffixes.

Known false positives

Some legitimate software was also seen using these names. Apply additional filters and use this rule as a hunting basis.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.