Elastic Defend high stable eql

Windows Error Manager/Reporting Masquerading

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

View Source

Detection Logic

sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and
   process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1 and process.parent.executable != null and
   not (process.args : "C:\\WINDOWS\\system32\\wermgr.exe  -upload" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe")]
  [network where event.action == "connection_attempted" and process.name : ("wermgr.exe", "WerFault.exe")]

Field Validations

Loading…

Comments (0)

Loading comments...