Windows File Creation: Non-System WerFault.exe Created in WinSxS
Flags creation of C:\Windows\WinSxS\WerFault.exe by processes outside core Windows system directories.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-10
- Updated
- 2026-07-31
What it detects
This rule flags file creation events where a process creates an executable named WerFault.exe located under the Windows WinSxS directory, as long as the creating process is not from common system locations. Attackers may use trusted-looking or system-related paths to blend in and establish persistence or execution footholds. The detection relies on Windows file event telemetry, specifically the target file path and the creating process image path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-file-event-non-system-creation-of-werfault-exe-in-winsxs-64827580
title: "Windows File Creation: Non-System WerFault.exe Created in WinSxS"
id: 5eb03af1-ef56-4fdc-8ae6-47298b974f6c
status: test
description: This rule flags file creation events where a process creates an executable named WerFault.exe located under the Windows WinSxS directory, as long as the creating process is not from common system locations. Attackers may use trusted-looking or system-related paths to blend in and establish persistence or execution footholds. The detection relies on Windows file event telemetry, specifically the target file path and the creating process image path.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/file_event_win_malware_snake_werfault_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
modified: 2023-05-18
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Windows\WinSxS\
TargetFilename|endswith: \WerFault.exe
filter_main_system_location:
Image|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Windows\WinSxS\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 64827580-e4c3-4c64-97eb-c72325d45399
type: derived