SNAKE Malware Service Persistence via WerFaultSvc
Detects the creation of a Windows service named "WerFaultSvc" with a specific ImagePath pattern, which has been identified as a persistence mechanism used by the SNAKE malware (also known as EKANS) as described in CISA reports. The rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, where the service name contains 'WerFaultSvc' and the ImagePath starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe'.
Sigma
