Windows Service Creation: WerFaultSvc (SCM Event 7045) for Turla PNG Dropper Indicators

title: "Windows Service Creation: WerFaultSvc (SCM Event 7045) for Turla PNG Dropper Indicators"
id: 03296f8e-885c-43c1-84e2-e9221840120f
status: test
description: This rule flags Windows Service Control Manager events where a service named "WerFaultSvc" is installed via service creation activity (EventID 7045). Attackers can use services for persistence and privilege abuse, and suspicious service naming can indicate dropper behavior matching the reported indicator. The detection relies on Windows System logs capturing Service Control Manager service installation details, specifically Provider_Name, EventID, and ServiceName.
references:
  - https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2017/TA/Turla/win_system_apt_turla_service_png.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2018-11-23
modified: 2021-11-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.g0010
  - attack.t1543.003
  - detection.emerging-threats
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: Service Control Manager
    EventID: 7045
    ServiceName: WerFaultSvc
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: 1228f8e2-7e79-4dea-b0ad-c91f1d5016c1
    type: derived