huntrule

Windows Registry Events Targeting SECURITY\Policy\Secrets\ for SNAKE Malware Persistence

Alerts on Windows registry activity targeting the SECURITY\Policy\Secrets\n registry key suffix.

FreeUnreviewedSigmahighv1
title: Windows Registry Events Targeting SECURITY\Policy\Secrets\ for SNAKE Malware Persistence
id: fc73afba-d6ce-4be4-922d-511337519c9c
status: test
description: This rule flags Windows registry activity where the target object ends with 'SECURITY\Policy\Secrets\n'. Such targeting is relevant for malware seeking persistence or covert configuration storage in a sensitive security-related registry area. It relies on registry_event telemetry capturing the TargetObject field for modifications, and matches on the specified suffix pattern.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/registry_event_malware_snake_covert_store_key.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-11
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  category: registry_event
  product: windows
detection:
  selection:
    TargetObject|endswith: SECURITY\Policy\Secrets\n
  condition: selection
level: high
license: DRL-1.1
related:
  - id: d0fa35db-0e92-400e-aa16-d32ae2521618
    type: derived

What it detects

This rule flags Windows registry activity where the target object ends with 'SECURITY\Policy\Secrets\n'. Such targeting is relevant for malware seeking persistence or covert configuration storage in a sensitive security-related registry area. It relies on registry_event telemetry capturing the TargetObject field for modifications, and matches on the specified suffix pattern.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.