Windows process creation: WerFault.exe executed with -pr flag
Alerts when WerFault.exe is launched with the -pr argument, potentially indicating ReflectDebugger-based execution.
- Product
- windows
- Category
- process_creation
- Author
- X__Junior (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-30
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags executions of WerFault.exe where the process creation command line includes the " -pr " argument. The behavior matters because this flag is used to run a file path stored in the ReflectDebugger registry location, which attackers may abuse to masquerade execution flow. Telemetry required is Windows process creation data containing the executable name and the full command line (including original filename metadata).
Reporting behind it
- cocomelonc.github.iohttps://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
- hexacorn.comhttps://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows process creation: WerFault.exe executed with -pr flag"
id: f0825eba-bb67-470a-b1ee-a72462eb572d
related:
- id: 0cf2e1c6-8d10-4273-8059-738778f981ad
type: derived
- id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
type: derived
status: test
description: This rule flags executions of WerFault.exe where the process creation command line includes the " -pr " argument. The behavior matters because this flag is used to run a file path stored in the ReflectDebugger registry location, which attackers may abuse to masquerade execution flow. Telemetry required is Windows process creation data containing the executable name and the full command line (including original filename metadata).
references:
- https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml
author: X__Junior (Nextron Systems), Huntrule Team
date: 2023-06-30
tags:
- attack.execution
- attack.stealth
- attack.t1036
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith: \WerFault.exe
- OriginalFileName: WerFault.exe
selection_cli:
CommandLine|contains: " -pr "
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1