Creation of WerFault.exe/Wer.dll in Unusual Folder

Title: Creation of WerFault.exe/Wer.dll in Unusual Folder
Status: test
Description:Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.
References:
  -https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/
Author: frack113
Date: 2022-05-09
modified:2026-05-18
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• product: windows
• category: file_event

Detection:
  selection:
    TargetFilename|endswith:
      -'\WerFault.exe'
      -'\wer.dll'

  filter_main_known_locations:
    TargetFilename|startswith:
      -'C:\Windows\SoftwareDistribution\'
      -'C:\Windows\System32\'
      -'C:\Windows\SysWOW64\'
      -'C:\Windows\WinSxS\'
      -'C:\Windows\UUS\'

  filter_main_process:
    Image|endswith: '\wuaucltcore.exe'
  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Unknown
Level: medium