huntrule

Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe

Alerts on Windows service creation of WerFaultSvc pointing to C:\Windows\WinSxS\...\WerFault.exe.

FreeReviewedSigma · Critical · v5
Product
windows
Service
system
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-05-10
Updated
2026-07-31
AnalysisDetection
title: Windows Service Creation for WerFaultSvc Using C:\Windows\WinSxS\WerFault.exe
id: 8105ea89-b4c7-47e3-b3b7-8a7caa56ed4a
status: test
description: This rule flags Windows System service creation events where the Service Control Manager registers a service named "WerFaultSvc". The persistence-relevant behavior is the association of that service to an executable path under C:\Windows\WinSxS\ and ending with \WerFault.exe, which is an unusual combination attackers may use to maintain execution. It relies on Windows service control manager telemetry (Event ID 7045) containing the provider name, service name, and image path.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/win_system_malware_snake_persistence_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-10
tags:
  - attack.persistence
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName|contains: WerFaultSvc
    ImagePath|startswith: C:\Windows\WinSxS\
    ImagePath|endswith: \WerFault.exe
  condition: selection
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: b2e60816-96b2-45bd-ba91-b63578c03ef6
    type: derived