Potential Encrypted Registry Blob Related To SNAKE Malware

Status: test
Severity: medium
Log source: category registry_set, product windows
Author: Nasreddine Bencherchali (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA

Known false positives

Some additional tuning might be required to tune out legitimate processes that write to this key by default

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 13: RegistryEvent (Value Set)

Rule body

title: Potential Encrypted Registry Blob Related To SNAKE Malware
id: 7e163e96-b9a5-45d6-b2cd-d7d87b13c60b
status: test
description: Detects the creation of a registry value in the ".wav\OpenWithProgIds" key with an uncommon name. This could be related to SNAKE Malware as reported by CISA
references:
    - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-05-10
modified: 2023-08-17
tags:
    - attack.persistence
    - detection.emerging-threats
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\SOFTWARE\Classes\.wav\OpenWithProgIds\'
    filter_main_wav:
        - TargetObject|endswith: '.AssocFile.WAV'
        - TargetObject|contains: '.wav.'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Some additional tuning might be required to tune out legitimate processes that write to this key by default
level: medium

Stages and Predicates

Stage 0: `condition`

selection and not 1 of filter_main_*

Stage 1: `selection`

selection:
    TargetObject|contains: '\SOFTWARE\Classes\.wav\OpenWithProgIds\'

Stage 2: `not filter_main_wav`

filter_main_wav:
    - TargetObject|endswith: '.AssocFile.WAV'
    - TargetObject|contains: '.wav.'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`TargetObject`	ends_with	`.AssocFile.WAV`	`excludes:TargetObject` `field:"TargetObject" value:".AssocFile.WAV"`
`TargetObject`	match	`.wav.`	`excludes:TargetObject` `field:"TargetObject" value:".wav."`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`TargetObject`	match	`\SOFTWARE\Classes\.wav\OpenWithProgIds\`	`field:"TargetObject" kind:match value:"\SOFTWARE\Classes\.wav\OpenWithProgIds\"`