Potential Windows Error Manager Masqueradingedit

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion

Version: 2 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 7.11.0

Rule authors: Elastic

Rule license: Elastic License

Potential false positivesedit

Legit Application Crash with rare Werfault commandline value

Rule queryedit

sequence by host.id, process.entity_id with maxspan = 5s [process
where event.type:"start" and process.name : ("wermgr.exe",
"WerFault.exe") and process.args_count == 1] [network where
process.name : ("wermgr.exe", "WerFault.exe") and network.protocol !=
"dns" and network.direction == "outgoing" and destination.ip
!="::1" and destination.ip !="127.0.0.1" ]

Threat mappingedit

Framework: MITRE ATT&CKTM

Rule version historyedit

Version 2 (7.11.0 release)
  • Rule name changed from: Process Potentially Masquerading as WerFault
  • Updated query, changed from:

    event.category:process and event.type:(start or process_started) and
    process.name:WerFault.exe and not process.args:((("-u" or "-pss") and
    "-p" and "-s") or ("/h" and "/shared") or ("-k" and "-lcq"))