Potential Windows Error Manager Masquerading

edit

Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching command-line and process executable values performing outgoing network connections. This may be indicative of a masquerading attempt to evade suspicious child process behavior detections.

Rule type: eql

Rule indices:

  • winlogbeat-*
  • logs-endpoint.events.*
  • logs-windows.*

Severity: medium

Risk score: 47

Runs every: 5 minutes

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Elastic
  • Host
  • Windows
  • Threat Detection
  • Defense Evasion

Version: 100 (version history)

Added (Elastic Stack release): 7.10.0

Last modified (Elastic Stack release): 8.5.0

Rule authors: Elastic

Rule license: Elastic License v2

Potential false positives

edit

Legit Application Crash with rare Werfault commandline value

Rule query

edit
sequence by host.id, process.entity_id with maxspan = 5s [process
where event.type:"start" and process.name : ("wermgr.exe",
"WerFault.exe") and process.args_count == 1] [network where
process.name : ("wermgr.exe", "WerFault.exe") and network.protocol !=
"dns" and network.direction : ("outgoing", "egress") and
destination.ip !="::1" and destination.ip !="127.0.0.1" ]

Threat mapping

edit

Framework: MITRE ATT&CKTM

Rule version history

edit
Version 100 (8.5.0 release)
  • Formatting only
Version 5 (8.4.0 release)
  • Formatting only
Version 4 (7.16.0 release)
  • Updated query, changed from:

    sequence by host.id, process.entity_id with maxspan = 5s [process
    where event.type:"start" and process.name : ("wermgr.exe",
    "WerFault.exe") and process.args_count == 1] [network where
    process.name : ("wermgr.exe", "WerFault.exe") and network.protocol !=
    "dns" and network.direction == "outgoing" and destination.ip
    !="::1" and destination.ip !="127.0.0.1" ]
Version 3 (7.12.0 release)
  • Formatting only
Version 2 (7.11.0 release)
  • Rule name changed from: Process Potentially Masquerading as WerFault
  • Updated query, changed from:

    event.category:process and event.type:(start or process_started) and
    process.name:WerFault.exe and not process.args:((("-u" or "-pss") and
    "-p" and "-s") or ("/h" and "/shared") or ("-k" and "-lcq"))