Detection rules › Sigma
PPL Tampering Via WerFaultSecure
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
Known false positives
- Legitimate usage of WerFaultSecure for debugging purposes
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Defense Impairment | |
| Credential Access |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Sysmon | Event ID 1: Process creation |
Rule body
title: PPL Tampering Via WerFaultSecure
id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
related:
- id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
type: similar
- id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
type: similar
status: experimental
description: |
Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
Distinct command line patterns help identify the specific tool:
- WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
- EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
references:
- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
- https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
author: Jason (https://github.com/0xbcf)
date: 2025-09-23
modified: 2025-11-23
tags:
- attack.defense-impairment
- attack.t1685
- attack.credential-access
- attack.t1003.001
logsource:
category: process_creation
product: windows
detection:
selection_image:
- Image|endswith: '\WerFaultSecure.exe'
- OriginalFileName: 'WerFaultSecure.exe'
selection_args:
CommandLine|contains|all:
- ' /h '
- ' /pid ' # Antimalware or EDR process pid will be after this flag
- ' /tid '
- ' /encfile '
- ' /cancel '
- ' /type '
- ' 268310'
condition: all of selection_*
falsepositives:
- Legitimate usage of WerFaultSecure for debugging purposes
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_image
selection_image:
- Image|endswith: '\WerFaultSecure.exe'
- OriginalFileName: 'WerFaultSecure.exe'
Stage 2: selection_args
selection_args:
CommandLine|contains|all:
- ' /h '
- ' /pid '
- ' /tid '
- ' /encfile '
- ' /cancel '
- ' /type '
- ' 268310'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
CommandLine | match |
| field:"CommandLine" kind:match |
Image | ends_with |
| field:"Image" kind:ends_with value:"\WerFaultSecure.exe" |
OriginalFileName | eq |
| field:"OriginalFileName" kind:eq value:"WerFaultSecure.exe" |