huntrule

Windows Process Creation: jpsetup.exe CLI Argument Hash/IV Sequence Indicator

Alerts on Windows process command lines containing a 64-hex then 16-hex CLI argument sequence consistent with a malware installer pattern.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: jpsetup.exe CLI Argument Hash/IV Sequence Indicator"
id: a476baea-4968-41b1-b030-e71eaec76b39
status: test
description: "This rule flags Windows process creation events where the command line contains a specific two-argument sequence: a 64-hex-character value followed by a 16-hex-character value. Such patterned CLI inputs can indicate malware installer execution using embedded cryptographic material, which attackers may use to control or decrypt payloads during installation. It relies on process_creation telemetry, specifically the full command line captured at process start."
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: \s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 02cbc035-b390-49fe-a9ff-3bb402c826db
    type: derived

What it detects

This rule flags Windows process creation events where the command line contains a specific two-argument sequence: a 64-hex-character value followed by a 16-hex-character value. Such patterned CLI inputs can indicate malware installer execution using embedded cryptographic material, which attackers may use to control or decrypt payloads during installation. It relies on process_creation telemetry, specifically the full command line captured at process start.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.