SNAKE Malware Installer Name Indicators

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects specific filenames, 'jpsetup.exe' and 'jpinst.exe', when they appear as the target filename in file events. These filenames have been associated with the SNAKE malware, as detailed in a CISA report. The rule aims to identify potential installations or presence of this malware on Windows systems.