Windows process command line matches SNAKE installer argument pattern

Alerts on Windows process command lines containing a 64-hex then 16-hex CLI argument sequence consistent with a malware installer pattern.

FreeReviewedSigma · High · v5
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-04
Updated
2026-07-31
title: Windows process command line matches SNAKE installer argument pattern
id: a476baea-4968-41b1-b030-e71eaec76b39
status: test
description: "This rule flags Windows process creation events where the command line contains a two-argument sequence that fits the installer’s expected format: a 64-hex-character value followed by a 16-hex-character value. Such argument patterns can be used by malware installers to pass encrypted or derived parameters needed for execution. The detection relies on process command line telemetry with sufficient fidelity to match the exact hex-length regular expression."
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_installer_cli_args.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: \s[a-fA-F0-9]{64}\s[a-fA-F0-9]{16}
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 02cbc035-b390-49fe-a9ff-3bb402c826db
    type: derived