Windows Service Creation for WerFaultSvc from WinSxS\WerFault.exe

title: Windows Service Creation for WerFaultSvc from WinSxS\WerFault.exe
id: 8105ea89-b4c7-47e3-b3b7-8a7caa56ed4a
status: test
description: This rule flags Windows Service Control Manager events where a new service named with the substring "WerFaultSvc" is created. It further requires the service binary path to start under C:\Windows\WinSxS\ and to end with \WerFault.exe, indicating a potential persistence setup via an installed service. Attackers often use services to achieve reliable execution on system startup, and this detection relies on Windows service creation telemetry (EventID 7045) that records the provider, service name, and configured executable path.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/win_system_malware_snake_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName|contains: WerFaultSvc
    ImagePath|startswith: C:\Windows\WinSxS\
    ImagePath|endswith: \WerFault.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: b2e60816-96b2-45bd-ba91-b63578c03ef6
    type: derived