Potential SNAKE Malware Persistence Service Execution
Detects a specific child/parent process relationship indicative of a "WerFault" process running from the "WinSxS" directory as a service. This behavior has been reported by CISA as indicative of potential SNAKE malware activity.
Sigma
