Windows: Detect execution of wsass.exe leveraging WerFaultSecure.exe via WER

title: "Windows: Detect execution of wsass.exe leveraging WerFaultSecure.exe via WER"
id: 06a32785-20a9-4a9b-a562-7dda97480f85
status: experimental
description: This rule flags process creation where wsass.exe is executed and its command line includes WerFaultSecure.exe with a numeric argument consistent with targeting LSASS by PID. Such activity is important because the combination is commonly used to attempt credential theft by dumping LSASS memory through Windows Error Reporting components. The detection relies on Windows process creation telemetry, matching wsass.exe by image name, an imphash value, and a regular expression over the command line structure.
references:
  - https://github.com/TwoSevenOneT/WSASS
  - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wsass.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-23
modified: 2026-01-09
tags:
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith: \wsass.exe
  selection_hash:
    Hashes|contains: IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42
  selection_cli:
    CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10}
  condition: 1 of selection_*
falsepositives:
  - Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml
license: DRL-1.1
related:
  - id: 589ac73f-8e12-409c-964e-31a2f5775ae2
    type: derived