Windows WSASS Process Execution via WerFaultSecure.EXE
Alerts on Windows process creation showing wsass.exe running with WerFaultSecure.exe and a PID-like argument.
- Product
- windows
- Category
- process_creation
- Author
- Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2025-11-23
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of wsass.exe on Windows when its command line uses WerFaultSecure.exe, along with a PID argument. Attackers use this technique to facilitate LSASS memory dumping by leveraging Windows Error Reporting components to interact with protected processes. The detection relies on Windows process creation telemetry, including the executed image filename, an imphash match, and a command-line pattern that ties wsass.exe to werfaultsecure.exe and a numeric PID.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows WSASS Process Execution via WerFaultSecure.EXE
id: 06a32785-20a9-4a9b-a562-7dda97480f85
status: experimental
description: This rule identifies execution of wsass.exe on Windows when its command line uses WerFaultSecure.exe, along with a PID argument. Attackers use this technique to facilitate LSASS memory dumping by leveraging Windows Error Reporting components to interact with protected processes. The detection relies on Windows process creation telemetry, including the executed image filename, an imphash match, and a command-line pattern that ties wsass.exe to werfaultsecure.exe and a numeric PID.
references:
- https://github.com/TwoSevenOneT/WSASS
- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_wsass.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-11-23
modified: 2026-01-09
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith: \wsass.exe
selection_hash:
Hashes|contains: IMPHASH=32F5095C9BBDCACF28FD4060EB4DFC42
selection_cli:
CommandLine|re: (?i)\.exe[\"\']?\s+[^\"]{0,64}werfaultsecure\.exe[\"\']?\s+\d{2,10}
condition: 1 of selection_*
falsepositives:
- Unlikely
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_wsass/info.yml
license: DRL-1.1
related:
- id: 589ac73f-8e12-409c-964e-31a2f5775ae2
type: derived