Windows Process Creation: WerFaultSecure.exe PPL Tampering with Dump/Impair Parameters

Alerts on WerFaultSecure.exe executions with PPL-related dump/impair command-line parameters that may target sensitive security protections.

FreeUnreviewedSigmahighv1

windows-process-creation-werfaultsecure-exe-ppl-tampering-with-dump-impair-param-1f0b4cac

title: "Windows Process Creation: WerFaultSecure.exe PPL Tampering with Dump/Impair Parameters"
id: 5bb27f6e-a922-4707-934e-1017614890a8
related:
  - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
    type: similar
  - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
    type: similar
  - id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
    type: derived
status: experimental
description: This rule flags process creation where WerFaultSecure.exe is invoked with specific command-line parameters consistent with tampering involving Protected Process Light (PPL), such as dumping PPL-protected processes or impairing security tooling. Attackers can use this type of behavior to access sensitive credential material or to interfere with EDR/antivirus protection. The detection relies on Windows process creation telemetry and matches both the executable identity (image/original file name) and required argument patterns in the command line.
references:
  - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
  - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
  - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
  - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml
author: Jason (https://github.com/0xbcf), Huntrule Team
date: 2025-09-23
modified: 2025-11-23
tags:
  - attack.defense-impairment
  - attack.t1685
  - attack.credential-access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    - Image|endswith: \WerFaultSecure.exe
    - OriginalFileName: WerFaultSecure.exe
  selection_args:
    CommandLine|contains|all:
      - " /h "
      - " /pid "
      - " /tid "
      - " /encfile "
      - " /cancel "
      - " /type "
      - " 268310"
  condition: all of selection_*
falsepositives:
  - Legitimate usage of WerFaultSecure for debugging purposes
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml
license: DRL-1.1

What it detects

This rule flags process creation where WerFaultSecure.exe is invoked with specific command-line parameters consistent with tampering involving Protected Process Light (PPL), such as dumping PPL-protected processes or impairing security tooling. Attackers can use this type of behavior to access sensitive credential material or to interfere with EDR/antivirus protection. The detection relies on Windows process creation telemetry and matches both the executable identity (image/original file name) and required argument patterns in the command line.

Known false positives

Legitimate usage of WerFaultSecure for debugging purposes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.