Potential ReflectDebugger Content Execution Via WerFault.EXE

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: X__Junior (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1036` Masquerading

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Potential ReflectDebugger Content Execution Via WerFault.EXE
id: fabfb3a7-3ce1-4445-9c7c-3c27f1051cdd
related:
    - id: 0cf2e1c6-8d10-4273-8059-738778f981ad
      type: derived
status: test
description: Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow
references:
    - https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
    - https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
author: X__Junior (Nextron Systems)
date: 2023-06-30
tags:
    - attack.execution
    - attack.stealth
    - attack.t1036
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        - Image|endswith: '\WerFault.exe'
        - OriginalFileName: 'WerFault.exe'
    selection_cli:
        CommandLine|contains: ' -pr '
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\WerFault.exe'
    - OriginalFileName: 'WerFault.exe'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' -pr '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-pr`	`field:"CommandLine" kind:match value:" -pr "`
`Image`	ends_with	`\WerFault.exe` corpus 8 (sigma 8)	`field:"Image" kind:ends_with value:"\WerFault.exe"`
`OriginalFileName`	eq	`WerFault.exe` corpus 3 (sigma 2, elastic 1)	`field:"OriginalFileName" kind:eq value:"WerFault.exe"`