{"id":"1f0b4cac-9c81-41f4-95d0-8475ff46b3e2","title":"PPL Tampering Via WerFaultSecure","description":"Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).\nThis technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.\nDistinct command line patterns help identify the specific tool:\n- WSASS usage typically shows: \"WSASS.exe WerFaultSecure.exe [PID]\" in ParentCommandLine\n- EDR-Freeze usage typically shows: \"EDR-Freeze_[version].exe [PID] [timeout]\" in ParentCommandLine\nLegitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.\n","author":"Jason (https://github.com/0xbcf)","status":"experimental","level":"high","date":"2025-09-23","modified":"2025-11-23","tags":["attack.defense-impairment","attack.t1685","attack.credential-access","attack.t1003.001"],"technique_ids":["T1003.001","T1685"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate usage of WerFaultSecure for debugging purposes"],"references":["https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html","https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53","https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html","https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251"],"source_path":"rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml","source_sha256":"cbd4733eb437dd0396dc30e63f96ca644c3da48aa56a9d93d6380276de9f886d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PPL Tampering Via WerFaultSecure\nid: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2\nrelated:\n    - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c\n      type: similar\n    - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b\n      type: similar\nstatus: experimental\ndescription: |\n    Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).\n    This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.\n    Distinct command line patterns help identify the specific tool:\n    - WSASS usage typically shows: \"WSASS.exe WerFaultSecure.exe [PID]\" in ParentCommandLine\n    - EDR-Freeze usage typically shows: \"EDR-Freeze_[version].exe [PID] [timeout]\" in ParentCommandLine\n    Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.\nreferences:\n    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html\n    - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53\n    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html\n    - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251\nauthor: Jason (https://github.com/0xbcf)\ndate: 2025-09-23\nmodified: 2025-11-23\ntags:\n    - attack.defense-impairment\n    - attack.t1685\n    - attack.credential-access\n    - attack.t1003.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_image:\n        - Image|endswith: '\\WerFaultSecure.exe'\n        - OriginalFileName: 'WerFaultSecure.exe'\n    selection_args:\n        CommandLine|contains|all:\n            - ' /h '\n            - ' /pid ' # Antimalware or EDR process pid will be after this flag\n            - ' /tid '\n            - ' /encfile '\n            - ' /cancel '\n            - ' /type '\n            - ' 268310'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate usage of WerFaultSecure for debugging purposes\nlevel: high\nregression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003.001","id":"T1003.001","name":"LSASS Memory","page":"techniques/enterprise/T1003.001/"},{"key":"enterprise/T1685","id":"T1685","name":"Disable or Modify Tools","page":"techniques/enterprise/T1685/"}],"data_path":"data/detection-rules/1f0b4cac-9c81-41f4-95d0-8475ff46b3e2.json","kind":"sigma"}