Potential SNAKE Malware Installation Binary Indicator

 1title: Potential SNAKE Malware Installation Binary Indicator
 2id: d91ff53f-fd0c-419d-a6b8-ae038d5c3733
 3status: test
 4description: Detects a specific binary name seen used by SNAKE malware during its installation as described by CISA in their report
 5references:
 6    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
 7author: Nasreddine Bencherchali (Nextron Systems)
 8date: 2023/05/04
 9tags:
10    - attack.execution
11    - detection.emerging_threats
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        Image|endswith:
18            - '\jpsetup.exe'
19            - '\jpinst.exe'
20    filter_main_cli_name:
21        CommandLine:
22            - 'jpinst.exe'
23            - 'jpinst'
24            - 'jpsetup.exe'
25            - 'jpsetup'
26    filter_main_cli_empty:
27        CommandLine: ''
28    filter_main_cli_null:
29        CommandLine: null
30    condition: selection and not 1 of filter_main_*
31falsepositives:
32    - Unlikely
33level: high