Detection of Snake Malware Kernel Driver Installation Artifacts

Snake Malware, also known as Turla, is a sophisticated threat targeting critical infrastructure and government entities. The malware employs a modular architecture that relies on custom kernel drivers to maintain deep control over compromised systems. A critical component of its installation routine is the creation of a file named 'comadmin.dat' within the '%windows%\system32\Com' directory. This file serves as a staging artifact for loading a kernel-mode driver, enabling the threat actor to bypass standard security controls, gain persistent access, and execute arbitrary code with elevated privileges. Monitoring for the creation of this specific file in the system32 directory provides a high-fidelity signal for detecting the active deployment phase of the Snake rootkit.

Attack Chain

1. Initial access is established via spearphishing or exploiting unpatched edge vulnerabilities.
2. The threat actor executes a dropper or installer to initiate the malware deployment.
3. The installer identifies the target system path for the rootkit components.
4. The installer writes 'comadmin.dat' to 'C:\Windows\system32\Com\'.
5. The malware performs a side-loading or registry manipulation to register the associated kernel driver.
6. The system is rebooted or a service is triggered to load the malicious driver into the Windows kernel.
7. The driver provides the attacker with kernel-level visibility and persistent control.
8. The final objective is the exfiltration of sensitive data or long-term espionage within the victim network.

Impact

Successful deployment of the Snake kernel driver grants the attacker full visibility into the compromised host's operating system, enabling the interception of network traffic, sensitive file access, and evasion of endpoint detection and response (EDR) agents. This threat is primarily observed in high-value, targeted espionage campaigns against government and diplomatic sectors.

Recommendation

• Deploy the Sigma rule below to monitor for the creation of the 'comadmin.dat' file in the specified system path.
• Enable Sysmon Event ID 11 (FileCreate) to capture the necessary telemetry for this detection.
• Investigate any detected 'comadmin.dat' file creations immediately, as this artifact is highly specific to Snake Malware.
• Review system and application logs for suspicious service installations or registry modifications corresponding to the timestamp of the file creation event.