Snake Malware Persistence via Malicious Windows Service

Snake malware, associated with the Russian-linked threat actor Turla, utilizes a stealthy persistence mechanism on compromised Windows hosts. The malware creates a malicious service named 'WerFaultSvc', designed to blend in with legitimate system reporting processes. To evade discovery, the malware places its malicious binary within the Windows Side-by-Side (WinSxS) directory, a common location for legitimate OS component files. This technique allows the actor to maintain long-term access and control over the infected system. Defender teams should focus on identifying this specific service name registration in conjunction with binary paths located in the WinSxS directory, as this is a primary indicator of Snake malware activity.

Attack Chain

1. Initial infection occurs via an unknown delivery vector (e.g., spearphishing or lateral movement).
2. The malware identifies the target environment and prepares for persistence installation.
3. The attacker drops a malicious binary into the C:\Windows\WinSxS directory to hide amongst legitimate system files.
4. The malware executes a service creation command to register 'WerFaultSvc' as a system service.
5. The Windows Service Control Manager (SCM) logs the event (EventCode 7045) confirming the installation of the rogue service.
6. The service starts automatically, triggering the malicious payload and ensuring persistence across system reboots.
7. The malware facilitates long-term system compromise, potential data exfiltration, and further C2 communications.

Impact

Snake malware provides attackers with advanced, long-term persistence capabilities on high-value systems. Successful deployment allows the operator to exfiltrate sensitive data, move laterally within the network, and maintain stealthy C2 channels that are difficult to detect due to the masquerading service names and locations.

Recommendation

Prioritized actions for detection engineering teams:

• Deploy the Sigma rule below to detect unauthorized service creation events associated with the Snake malware signature.
• Configure SIEM or log management systems to alert on Windows System Event 7045 whenever a service named 'WerFaultSvc' is created.
• Hunt historically for these artifacts using the EventCode 7045 search provided in the brief.