Windows process creation: WerFault.exe executed with -pr flag

title: "Windows process creation: WerFault.exe executed with -pr flag"
id: f0825eba-bb67-470a-b1ee-a72462eb572d
related:
  - id: 0cf2e1c6-8d10-4273-8059-738778f981ad
    type: derived
  - id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
    type: derived
status: test
description: This rule flags executions of WerFault.exe where the process creation command line includes the " -pr " argument. The behavior matters because this flag is used to run a file path stored in the ReflectDebugger registry location, which attackers may abuse to masquerade execution flow. Telemetry required is Windows process creation data containing the executable name and the full command line (including original filename metadata).
references:
  - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
  - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-30
tags:
  - attack.execution
  - attack.stealth
  - attack.t1036
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    - Image|endswith: \WerFault.exe
    - OriginalFileName: WerFault.exe
  selection_cli:
    CommandLine|contains: " -pr "
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1