Windows process execution: WerFault.exe launched from WinSxS by services.exe
Alerts on WerFault.exe running from WinSxS when spawned by services.exe on Windows.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-04
- Updated
- 2026-07-31
What it detects
This rule flags process creation where services.exe starts WerFault.exe, with the WerFault executable path under C:\Windows\WinSxS\ and ending in \WerFault.exe. The WerFault binary is commonly used for Windows error reporting, but unusual parent-child relationships and nonstandard execution paths can indicate malware persistence or execution chaining. The detection relies on Windows process creation telemetry capturing both parent image and full child image path.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-service-werfault-child-process-from-winsxs-path-f7536642
title: "Windows process execution: WerFault.exe launched from WinSxS by services.exe"
id: b03c6561-6abc-4307-9a2e-f37de8645ea8
status: test
description: This rule flags process creation where services.exe starts WerFault.exe, with the WerFault executable path under C:\Windows\WinSxS\ and ending in \WerFault.exe. The WerFault binary is commonly used for Windows error reporting, but unusual parent-child relationships and nonstandard execution paths can indicate malware persistence or execution chaining. The detection relies on Windows process creation telemetry capturing both parent image and full child image path.
references:
- https://media.defense.gov/2023/May/09/2003218554/-1/-1/0/JOINT_CSA_HUNTING_RU_INTEL_SNAKE_MALWARE_20230509.PDF
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/SNAKE/proc_creation_win_malware_snake_service_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
- attack.execution
- detection.emerging-threats
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \services.exe
Image|startswith: C:\Windows\WinSxS\
Image|endswith: \WerFault.exe
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: f7536642-4a08-4dd9-b6d5-c3286d8975ed
type: derived