UNC6692 SNOW Malware Staging Path Execution

Elgonad .@elgonad

•updated Apr 23, 2026•1•0•249

Detects process execution originating from the C:\ProgramData\log\ directory. This specific path is utilized as a staging directory by UNC6692 to execute their SNOWGLAZE tunneler and SNOWBASIN bindshell malware payloads.