Sigma rule: Suspicious Werfault.exe Network Connection Outbound

Rule

Title

Suspicious Werfault.exe Network Connection Outbound

Status

experimental

Level

medium

Author

Sreeman

Date

2021/03/09

Modified

2021/06/11

File

unsupported/windows/win_suspicious_werfault_connection_outbound.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.

Log source

product

windows

category

network_connection

Detection

selection:
  Image: 'werfault.exe'
filter1:
  ParentImage: 'svchost.exe'
filter2:
  DestinationIp:
      - '104.42.151.234'
      - '104.43.193.48'
      - '52.255.188.83'
      - '13.64.90.137'
      - '168.61.161.212'
      - '13.88.21.125'
      - '40.88.32.150'
      - '52.147.198.201'
      - '52.239.207.100'
      - '52.176.224.96'
      - '2607:7700:0:24:0:1:287e:1894'
      - '10.*'
      - '192.168.*'
      - '127.*'
filter3:
  DestinationHostname|contains:
      - '*.windowsupdate.com'
      - '*.microsoft.com'
condition: selection and not ( filter1 and filter2 and filter3 )

False positives (as the rule lists them)

• Communication to other corporate systems that use IP addresses from public address spaces and Microsoft IP spaces

Tags

• attack.command_and_control
• attack.t1571

MITRE ATT&CK ids this rule names

• T1571

References

• https://thedfirreport.com/2021/03/08/bazar-drops-the-anchor/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/win_suspicious_werfault_connection_outbound.yml