sigmahighHunting

PPL Tampering Via WerFaultSecure

Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus). This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software. Distinct command line patterns help identify the specific tool: - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.

MITRE ATT&CK

T1562.001 T1003.001

defense-evasioncredential-access

Detection Query

selection_image:
  - Image|endswith: \WerFaultSecure.exe
  - OriginalFileName: WerFaultSecure.exe
selection_args:
  CommandLine|contains|all:
    - " /h "
    - " /pid "
    - " /tid "
    - " /encfile "
    - " /cancel "
    - " /type "
    - " 268310"
condition: all of selection_*

Author

Jason (https://github.com/0xbcf)

Created

2025-09-23

Data Sources

windowsProcess Creation Events

Platforms

windows

References

Tags

attack.defense-evasionattack.t1562.001attack.credential-accessattack.t1003.001

Raw Content

title: PPL Tampering Via WerFaultSecure
id: 1f0b4cac-9c81-41f4-95d0-8475ff46b3e2
related:
    - id: 387df17d-3b04-448f-8669-9e7fd5e5fd8c
      type: similar
    - id: 8a2f4b1c-3d5e-4f7a-9b2c-1e4f6d8a9c2b
      type: similar
status: experimental
description: |
    Detects potential abuse of WerFaultSecure.exe to dump Protected Process Light (PPL) processes like LSASS or to freeze security solutions (EDR/antivirus).
    This technique is used by tools such as EDR-Freeze and WSASS to bypass PPL protections and access sensitive information or disable security software.
    Distinct command line patterns help identify the specific tool:
    - WSASS usage typically shows: "WSASS.exe WerFaultSecure.exe [PID]" in ParentCommandLine
    - EDR-Freeze usage typically shows: "EDR-Freeze_[version].exe [PID] [timeout]" in ParentCommandLine
    Legitimate debugging operations using WerFaultSecure are rare in production environments and should be investigated.
references:
    - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
    - https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
    - https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
    - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
author: Jason (https://github.com/0xbcf)
date: 2025-09-23
modified: 2025-11-23
tags:
    - attack.defense-evasion
    - attack.t1562.001
    - attack.credential-access
    - attack.t1003.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        - Image|endswith: '\WerFaultSecure.exe'
        - OriginalFileName: 'WerFaultSecure.exe'
    selection_args:
        CommandLine|contains|all:
            - ' /h '
            - ' /pid ' # Antimalware or EDR process pid will be after this flag
            - ' /tid '
            - ' /encfile '
            - ' /cancel '
            - ' /type '
            - ' 268310'
    condition: all of selection_*
falsepositives:
    - Legitimate usage of WerFaultSecure for debugging purposes
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_werfaultsecure_abuse/info.yml