Potential SNAKE Malware Installation Command Line Arguments
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
Sigma
