Sigma rule: Creation of WerFault.exe/Wer.dll in Unusual Folder

Rule

Title

Creation of WerFault.exe/Wer.dll in Unusual Folder

Status

test

Level

medium

Author

frack113

Date

2022-05-09

Modified

2026-05-18

File

rules/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.

Log source

product

windows

category

file_event

Detection

selection:
    TargetFilename|endswith:
        - '\WerFault.exe'
        - '\wer.dll'
filter_main_known_locations:
    TargetFilename|startswith:
        - 'C:\Windows\SoftwareDistribution\'
        - 'C:\Windows\System32\'
        - 'C:\Windows\SysWOW64\'
        - 'C:\Windows\WinSxS\'
        - 'C:\Windows\UUS\' # covers both C:\Windows\UUS\arm64\ and C:\Windows\UUS\packages\
filter_main_process:
    Image|endswith: '\wuaucltcore.exe'
condition: selection and not 1 of filter_main_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.privilege-escalation
• attack.persistence
• attack.execution
• attack.stealth
• attack.t1574.001

MITRE ATT&CK ids this rule names

• T1574.001

References

• https://www.bleepingcomputer.com/news/security/hackers-are-now-hiding-malware-in-windows-event-logs/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_werfault_dll_hijacking.yml