Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe
Alerts on Windows service creation of WerFaultSvc pointing to C:\Windows\WinSxS\...\WerFault.exe.
FreeReviewedSigma · Critical · v5
- Product
- windows
- Service
- system
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-10
- Updated
- 2026-07-31
What it detects
This rule flags Windows System service creation events where the Service Control Manager registers a service named "WerFaultSvc". The persistence-relevant behavior is the association of that service to an executable path under C:\Windows\WinSxS\ and ending with \WerFault.exe, which is an unusual combination attackers may use to maintain execution. It relies on Windows service control manager telemetry (Event ID 7045) containing the provider name, service name, and image path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-creation-for-werfaultsvc-from-winsxs-werfault-exe-b2e60816
title: Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe
id: 8105ea89-b4c7-47e3-b3b7-8a7caa56ed4a
status: test
description: This rule flags Windows System service creation events where the Service Control Manager registers a service named "WerFaultSvc". The persistence-relevant behavior is the association of that service to an executable path under C:\Windows\WinSxS\ and ending with \WerFault.exe, which is an unusual combination attackers may use to maintain execution. It relies on Windows service control manager telemetry (Event ID 7045) containing the provider name, service name, and image path.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/win_system_malware_snake_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
- attack.persistence
- detection.emerging-threats
logsource:
product: windows
service: system
detection:
selection:
Provider_Name: Service Control Manager
EventID: 7045
ServiceName|contains: WerFaultSvc
ImagePath|startswith: C:\Windows\WinSxS\
ImagePath|endswith: \WerFault.exe
condition: selection
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: b2e60816-96b2-45bd-ba91-b63578c03ef6
type: derived