Windows Service-WerFault Child Process From WinSxS Path

Alerts on WerFault.exe running from WinSxS when spawned by services.exe on Windows.

FreeUnreviewedSigmahighv1

windows-service-werfault-child-process-from-winsxs-path-f7536642

title: Windows Service-WerFault Child Process From WinSxS Path
id: b03c6561-6abc-4307-9a2e-f37de8645ea8
status: test
description: This rule flags process executions where WerFault.exe runs from a Windows WinSxS directory while being launched by services.exe. Such a child/parent relationship and path pattern may indicate suspicious persistence-related activity leveraging Windows error reporting binaries. It relies on Windows process creation telemetry capturing process image paths and the parent process relationship.
references:
  - https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_service_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \services.exe
    Image|startswith: C:\Windows\WinSxS\
    Image|endswith: \WerFault.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f7536642-4a08-4dd9-b6d5-c3286d8975ed
    type: derived

What it detects

This rule flags process executions where WerFault.exe runs from a Windows WinSxS directory while being launched by services.exe. Such a child/parent relationship and path pattern may indicate suspicious persistence-related activity leveraging Windows error reporting binaries. It relies on Windows process creation telemetry capturing process image paths and the parent process relationship.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.