Sprysocks Rawwnpf Rootkit Component Detection

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•1•1•2

This YARA rule detects components associated with the SprySocks malware, specifically looking for the '\Device\RawWNPF' device name in conjunction with kernel concealment-related API strings such such as 'NtQuerySystemInformation', 'nsiproxy', 'FwpmFilterAdd', and 'KdDisableDebugger'. The presence of these strings together indicates potential rootkit activity aimed at hiding malicious processes or network activity.