Potential SNAKE Malware Installation Binary Indicator
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
Sigma
