Detection rules › Sigma

PPL Tampering Via WerFaultSecure

Severity
high
Author
Jason (https://github.com/0xbcf)
Source
upstream

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

MITRE ATT&CK coverage

TacticTechniques
Defense EvasionT1562.001 Impair Defenses: Disable or Modify Tools
Credential AccessT1003.001 OS Credential Dumping: LSASS Memory

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation

Stages and Predicates

Stage 1: all of selection_image

or:
Image|endswith: '\WerFaultSecure.exe'
OriginalFileName: WerFaultSecure.exe

Stage 2: all of selection_args

CommandLine|contains: ' /cancel '
CommandLine|contains: ' /encfile '
CommandLine|contains: ' /h '
CommandLine|contains: ' /pid '
CommandLine|contains: ' /tid '
CommandLine|contains: ' /type '
CommandLine|contains: ' 268310'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
CommandLinematch
  • /cancel
  • /encfile
  • /h
  • /pid
  • /tid
  • /type
  • 268310
Imageends_with
  • \WerFaultSecure.exe corpus 2 (sigma 2)
OriginalFileNameeq
  • WerFaultSecure.exe