Query: write Sigma for Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze se
Matching passage: Sigma rule: Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze se. Logsource: windows / process_creation. Rule: title: PPL Tampering Via WerFaultSecure id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2 related: - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c type: similar - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b type: similar status: experimental description: 'Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated. ' references: - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 author: Jason (https://github.com/0xbcf) date: 2025-09-23 modified: 2025-11-23 tags: - attack.defense-impairment - attack.t1685 - attack.credential-access - attack.t1003.001 logsource: category: process_creation product: windows detection: selection_image: - Image|endswith: \WerFaultSecure.exe - OriginalFileName: WerFaultSecure.exe selection_args: CommandLine|contains|all: - ' /h ' - ' /pid ' - ' /tid ' - ' /encfile ' - ' /cancel ' - ' /type ' - ' 268310' condition: all of selection_* falsepositives: - Legitimate usage of WerFaultSecure for debugging purposes level: high regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml
Near-miss passage: Sigma rule: Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the. Logsource: windows / process_creation. Rule: title: Security Event Logging Disabled via MiniNt Registry Key - Process id: 1a4bd6af-99ac-4466-b5b2-7b72b4a05462 related: - id: 8839e550-52d7-4958-9f2f-e13c1e736838 type: similar status: experimental description: 'Detects attempts to disable security event logging by adding the `MiniNt` registry key. This key is used to disable the Windows Event Log service, which collects and stores event logs from the operating system and applications. Adversaries may want to disable this service to prevent logging of security events that could be used to detect their activities. ' references: - https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-04-09 tags: - attack.persistence - attack.defense-impairment - attack.t1685.001 - attack.t1112 - car.2022-03-001 logsource: category: process_creation product: windows detection: selection_reg_img: - Image|endswith: \reg.exe - OriginalFileName: reg.exe selection_reg_cmd: CommandLine|contains|all: - ' add ' - \SYSTEM\CurrentControlSet\Control\MiniNt selection_powershell_img: - Image|endswith: - \powershell.exe - \pwsh.exe - \powershell_ise.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_powershell_cmd1: CommandLine|contains: - 'New-Item ' - 'ni ' selection_powershell_cmd2: CommandLine|contains: \SYSTEM\CurrentControlSet\Control\MiniNt condition: all of selection_reg_* or all of selection_powershell_* falsepositives: - Highly Unlikely level: high