SNAKE Malware WerFault Persistence File Creation
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
Sigma
