Windows process command line matches SNAKE installer argument pattern
Alerts on Windows process command lines containing a 64-hex then 16-hex CLI argument sequence consistent with a malware installer pattern.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-04
- Updated
- 2026-07-31
What it detects
This rule flags Windows process creation events where the command line contains a two-argument sequence that fits the installer’s expected format: a 64-hex-character value followed by a 16-hex-character value. Such argument patterns can be used by malware installers to pass encrypted or derived parameters needed for execution. The detection relies on process command line telemetry with sufficient fidelity to match the exact hex-length regular expression.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-process-creation-jpsetup-exe-cli-argument-hash-iv-sequence-indicator-02cbc035
title: Windows process command line matches SNAKE installer argument pattern
id: a476baea-4968-41b1-b030-e71eaec76b39
status: test
description: "This rule flags Windows process creation events where the command line contains a two-argument sequence that fits the installer’s expected format: a 64-hex-character value followed by a 16-hex-character value. Such argument patterns can be used by malware installers to pass encrypted or derived parameters needed for execution. The detection relies on process command line telemetry with sufficient fidelity to match the exact hex-length regular expression."
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|re: \s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 02cbc035-b390-49fe-a9ff-3bb402c826db
type: derived