Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Read More

Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report

Read More

Detects a specific command line arguments sequence seen used by SNAKE malware during its installation as described by CISA in their report

Read More

Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" as a service. This could be indicative of potential SNAKE malware activity as reported by CISA.

Read More

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

Read More

Detects filename indicators associated with the SNAKE malware as reported by CISA in their report

Read More

Detects SNAKE malware kernel driver file indicator

Read More

Detects the creation of a service named "WerFaultSvc" which seems to be used by the SNAKE malware as a persistence mechanism as described by CISA in their report

Read More

Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process, which can be indicative of potential SNAKE malware activity

Read More