detection.wiki

Detection rules › Sigma

Creation of WerFault.exe/Wer.dll in Unusual Folder

Status
test
Severity
medium
Log source
product windows, category file_event
Author
frack113
Source
github.com/SigmaHQ/sigma

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1574.001 Hijack Execution Flow: DLL
StealthT1574.001 Hijack Execution Flow: DLL

Event coverage

ProviderEventTitle
SysmonEvent ID 11FileCreate

Rule body yaml

title: Creation of WerFault.exe/Wer.dll in Unusual Folder
id: 28a452f3-786c-4fd8-b8f2-bddbe9d616d1
status: test
description: Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
references:
    - https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/
author: frack113
date: 2022-05-09
modified: 2026-05-18
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.execution
    - attack.stealth
    - attack.t1574.001
logsource:
    product: windows
    category: file_event
detection:
    selection:
        TargetFilename|endswith:
            - '\WerFault.exe'
            - '\wer.dll'
    filter_main_known_locations:
        TargetFilename|startswith:
            - 'C:\Windows\SoftwareDistribution\'
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
            - 'C:\Windows\WinSxS\'
            - 'C:\Windows\UUS\' # covers both C:\Windows\UUS\arm64\ and C:\Windows\UUS\packages\
    filter_main_process:
        Image|endswith: '\wuaucltcore.exe'
    condition: selection and not 1 of filter_main_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

selection and not 1 of filter_main_*

Stage 1: selection

selection:
    TargetFilename|endswith:
        - '\WerFault.exe'
        - '\wer.dll'

Stage 2: not filter_main_*

filter_main_known_locations:
    TargetFilename|startswith:
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\Windows\UUS\'
filter_main_process:
    Image|endswith: '\wuaucltcore.exe'

Exclusions

Top-level NOT(...) conjuncts: predicates this rule actively suppresses.

FieldKindExcluded values
Imageends_with\wuaucltcore.exe
TargetFilenamestarts_withC:\Windows\SoftwareDistribution\
TargetFilenamestarts_withC:\Windows\SysWOW64\
TargetFilenamestarts_withC:\Windows\System32\
TargetFilenamestarts_withC:\Windows\UUS\
TargetFilenamestarts_withC:\Windows\WinSxS\

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
TargetFilenameends_with
  • \WerFault.exe corpus 3 (sigma 3)
  • \wer.dll