Windows file events matching SNAKE-related installer filename indicators
Flags Windows file events with target filenames ending in common SNAKE installer indicators like jpsetup.exe and jpinst.exe.
FreeReviewedSigma · Low · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-10
- Updated
- 2026-07-31
What it detects
This rule identifies Windows file creation or execution activity where the target filename ends with either \jpsetup.exe or \jpinst.exe, based on filename indicators reported by CISA for SNAKE malware. Attackers may use these masqueraded installer filenames to stage or run malicious components while blending in with plausible software naming. The detection relies on Windows file event telemetry that records the target filename.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-events-snake-malware-installer-filename-indicators-99eccc2b
title: Windows file events matching SNAKE-related installer filename indicators
id: b57db4bd-1cde-426f-bd29-653be04f43ca
status: test
description: This rule identifies Windows file creation or execution activity where the target filename ends with either \jpsetup.exe or \jpinst.exe, based on filename indicators reported by CISA for SNAKE malware. Attackers may use these masqueraded installer filenames to stage or run malicious components while blending in with plausible software naming. The detection relies on Windows file event telemetry that records the target filename.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_installers_ioc.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith:
- \jpsetup.exe
- \jpinst.exe
condition: selection
falsepositives:
- Some legitimate software was also seen using these names. Apply additional filters and use this rule as a hunting basis.
level: low
license: DRL-1.1
related:
- id: 99eccc2b-7182-442f-8806-b76cc36d866b
type: derived