huntrule

Windows File Event: Non-System Creation of WerFault.exe in WinSxS

Flags creation of C:\Windows\WinSxS\WerFault.exe by processes outside core Windows system directories.

FreeUnreviewedSigmahighv1
title: "Windows File Event: Non-System Creation of WerFault.exe in WinSxS"
id: 5eb03af1-ef56-4fdc-8ae6-47298b974f6c
status: test
description: This rule identifies file creation events where a non-system process creates a file named WerFault.exe located in the C:\Windows\WinSxS\ directory. Attackers may abuse legitimate Windows component paths to blend in with expected system files and persistence artifacts. The detection relies on Windows file event telemetry capturing the target path/filename and the creating process image path for exclusion of common system locations.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
modified: 2023-05-18
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Windows\WinSxS\
    TargetFilename|endswith: \WerFault.exe
  filter_main_system_location:
    Image|startswith:
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 64827580-e4c3-4c64-97eb-c72325d45399
    type: derived

What it detects

This rule identifies file creation events where a non-system process creates a file named WerFault.exe located in the C:\Windows\WinSxS\ directory. Attackers may abuse legitimate Windows component paths to blend in with expected system files and persistence artifacts. The detection relies on Windows file event telemetry capturing the target path/filename and the creating process image path for exclusion of common system locations.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.