APT37 Ruby Runtime Masquerading (SNAKEDROPPER)
Detects the creation of a Ruby runtime environment in unusual ProgramData subdirectories and the renaming of the Ruby interpreter to masquerade as a USB utility, a technique used by APT37's SNAKEDROPPER malware. Specifically looks for file events in 'C:\ProgramData\usbspeed' or 'C:\ProgramData\ruby3' where the filename is 'usbspeed.exe' or the previous filename was 'rubyw.exe'.
Microsoft Sentinel (KQL)
