Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Hunting New Variant of Snake Keylogger

Steven Lim@KQLWizard

•updated Jul 1, 2025•6•0•73

KQL Query from file: Hunting New Variant of Snake Keylogger

Microsoft Sentinel (KQL)

Tags

S0022 - Uroburos T1036.005 - Match Legitimate Resource Name or Location G0010 - Turla T1056.001 - Keylogging T1059.010 - AutoHotKey & AutoIT T1055.012 - Process Hollowing T1566 - Phishing T1566.002 - Spearphishing Link T1020 - Automated Exfiltration T1567.004 - Exfiltration Over Webhook TA0005 - Defense Evasion TA0009 - Collection TA0006 - Credential Access TA0002 - Execution TA0004 - Privilege Escalation TA0001 - Initial Access TA0010 - Exfiltration File Event Network Connection Email Attachment Downloaded Email Malware Detected Data Exfiltration Windows Office 365 Windows Defender Atp M365 Unified Audit Logkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?