Windows: WerFault.exe/Wer.dll Created in Uncommon Directory

Alerts on newly created WerFault.exe or wer.dll in non-standard locations, suggesting potential DLL hijacking activity.

FreeUnreviewedSigmamediumv1

windows-werfault-exe-wer-dll-created-in-uncommon-directory-28a452f3

title: "Windows: WerFault.exe/Wer.dll Created in Uncommon Directory"
id: 7e45ff87-cf72-4fd3-93d6-8d80eef36805
status: test
description: This rule flags file creation events where the target filename ends with WerFault.exe or wer.dll, but the full path is not within common Windows directories excluded by the rule. Attackers can abuse WerFault DLL hijacking techniques to load malicious or replacement components while masquerading as legitimate Windows binaries. The detection relies on Windows file event telemetry that includes the created file path and the creating process image for filtering.
references:
  - https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml
author: frack113, Huntrule Team
date: 2022-05-09
modified: 2026-05-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: windows
  category: file_event
detection:
  selection:
    TargetFilename|endswith:
      - \WerFault.exe
      - \wer.dll
  filter_main_known_locations:
    TargetFilename|startswith:
      - C:\Windows\SoftwareDistribution\
      - C:\Windows\System32\
      - C:\Windows\SysWOW64\
      - C:\Windows\WinSxS\
      - C:\Windows\UUS\
  filter_main_process:
    Image|endswith: \wuaucltcore.exe
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 28a452f3-786c-4fd8-b8f2-bddbe9d616d1
    type: derived

What it detects

This rule flags file creation events where the target filename ends with WerFault.exe or wer.dll, but the full path is not within common Windows directories excluded by the rule. Attackers can abuse WerFault DLL hijacking techniques to load malicious or replacement components while masquerading as legitimate Windows binaries. The detection relies on Windows file event telemetry that includes the created file path and the creating process image for filtering.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.