Snake Keylogger PowerShell Download and Execute

Kaung Khant Ko@kaungkhantko

•updated Oct 12, 2025•4•0•402

Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.