WerFaultSecure Unusual Path Execution

[BIitzkrieg]

Description of the Idea of the Rule

Detect potential LSASS dumping via werfaultsecure.exe

Public References / Example Event Log

Reference:
https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html

Proposed rule:

title: WerFaultSecure Unusual Path Execution
description: >
    This analytic looks for the Windows 8.1 binary "WerFaultSecure" running out
    of an unusual path. A specific Windows 8.1 version of this binary can be
    used alongside the WSASS tool to dump the memory of processes protected by
    PPL (Protected Process Light), such as LSASS.
author: andrewdanis
references:
    - >-
        https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
logsource:
    category: process_creation
    product: windows
    service: sysmon
detection:
    condition: Section_1 and not Section_2
    Section_1:
        Image|endswith: \WerFaultSecure.exe
    Section_2:
        Image|startswith:
            - C:\Windows\System32
            - C:\Windows\SysWOW64
license_url: ''

Example Event Log:

Channel: Microsoft-Windows-Sysmon/Operational
CommandLine: WerFaultSecure.exe /h /pid 620 /tid 648 /file 172 /encfile 176 /cancel 180 /type 268310
Company: Microsoft Corporation
CurrentDirectory: C:\Users\user\Desktop\WSASS_Release_1.0\
Description: Windows Fault Reporting
EventCode: 1
EventDescription: Process creation
EventID: 1
EventRecordID: 1074
FileVersion: 6.3.9600.17415 (winblue_r4.141028-1500)
Hashes: MD5=DEEF74F6208E8A4262861CFCE0F96436
SHA256=C9F83BB03B45688EAAD3306C63D3A0005662454B0423A50CC86EFE9E8819A6CE
IMPHASH=2E5B5B16A6CEFB835497E6D326285130
IMPHASH: 2E5B5B16A6CEFB835497E6D326285130
Image: C:\Users\user\Desktop\WSASS_Release_1.0\WerFaultSecure.exe
IntegrityLevel: High
Keywords: 0x8000000000000000
Level: 4
LogonGuid: 2835B818-365E-68C8-528F-030000000000
LogonId: 0x38f52
MD5: DEEF74F6208E8A4262861CFCE0F96436
Name: "Microsoft-Windows-Sysmon"
Opcode: 0
OriginalFileName: WerFaultSecure.exe
ParentCommandLine: WSASS.exe  WerFaultSecure.exe 620
ParentImage: C:\Users\user\Desktop\WSASS_Release_1.0\WSASS.exe
ParentProcessGuid: 2835B818-36F3-68C8-3705-000000004303
ParentProcessId: 8212
ParentProcessName: WSASS.exe
ParentProcessPath: C:\Users\user\Desktop\WSASS_Release_1.0\
ParentUser: EC2AMAZ-UGL8NO0\user
ProcessGuid: 2835B818-36F3-68C8-3805-000000004303
ProcessID: "2792"
ProcessId: 9008
ProcessName: WerFaultSecure.exe
ProcessPath: C:\Users\user\Desktop\WSASS_Release_1.0\
Product: Microsoft® Windows® Operating System
RecordNumber: 1074
SHA256: C9F83BB03B45688EAAD3306C63D3A0005662454B0423A50CC86EFE9E8819A6CE
SigmaEventCode: 1
SystemTime: '2025-09-15T15:55:31.881815Z'
Task: 1
TerminalSessionId: 2
ThreadID: "4264"
User: EC2AMAZ-UGL8NO0\user
UserID: "S-1-5-18"
UtcTime: 2025-09-15 15:55:31.881
Version: 5
action: allowed
dest: EC2AMAZ-UGL8NO0
event_id: 1074
id: 1074
original_file_name: WerFaultSecure.exe
os: Microsoft Windows
parent_process: WSASS.exe  WerFaultSecure.exe 620
parent_process_exec: WSASS.exe
parent_process_guid: 2835B818-36F3-68C8-3705-000000004303
parent_process_id: 8212
parent_process_name: WSASS.exe
parent_process_path: C:\Users\user\Desktop\WSASS_Release_1.0\WSASS.exe
process: WerFaultSecure.exe /h /pid 620 /tid 648 /file 172 /encfile 176 /cancel 180 /type 268310
process_current_directory: C:\Users\user\Desktop\WSASS_Release_1.0\
process_exec: WerFaultSecure.exe
process_guid: 2835B818-36F3-68C8-3805-000000004303
process_hash: MD5=DEEF74F6208E8A4262861CFCE0F96436
SHA256=C9F83BB03B45688EAAD3306C63D3A0005662454B0423A50CC86EFE9E8819A6CE
IMPHASH=2E5B5B16A6CEFB835497E6D326285130
process_id: 9008
process_integrity_level: High
process_name: WerFaultSecure.exe
process_path: C:\Users\user\Desktop\WSASS_Release_1.0\WerFaultSecure.exe
sigma_category: process_creation
sigma_product: windows
sigma_service: sysmon
signature: Process creation
signature_id: 1
snapattack_session: df379bca-5902-d110-75a1-de665c52d15e
user: user
user_id: "S-1-5-18"
vendor_product: Microsoft Sysmon

[swachchhanda000]

Hi @BIitzkrieg,
Thanks for the reporting. We already have an outstanding PR (#5663) solving just that.

Thanks