detection.wiki

Detection rules › Sigma

SNAKE Malware Covert Store Registry Key

Status
test
Severity
high
Log source
product windows, category registry_event
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA

MITRE ATT&CK coverage

TacticTechniques
PersistenceNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)

Rule body yaml

title: SNAKE Malware Covert Store Registry Key
id: d0fa35db-0e92-400e-aa16-d32ae2521618
status: test
description: Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n' which is a key related to SNAKE malware as described by CISA
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-11
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|endswith: 'SECURITY\Policy\Secrets\n'
    condition: selection
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetObject|endswith: 'SECURITY\Policy\Secrets\n'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetObjectends_with
  • SECURITY\Policy\Secrets\n