Windows Snake Malware Kernel Driver Comadmin File Creation
The analytic detects the creation of the 'comadmin.dat' file in the '%windows%\system32\Com' directory. This file is associated with Snake Malware's installation process, which involves dropping a kernel driver and a custom DLL. The presence of this file indicates potential compromise, leading to privilege escalation and persistent access through a malicious kernel driver.
Splunk (SPL)
