EDR-Freeze - WerFaultSecure Unusual Parent Process
NOTE: big kudos to "F S"@Fsdr, as i mainly took his query. Just saw a little error at the risk level association while testing. Must be looking for InitiatingProcessFolderPath as it contains complete path and InitiatingProcessFileName just the FileName (without path). Tested with https://github.com/TwoSevenOneT/WSASS -- original description from @fsdr -- This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
Microsoft Sentinel (KQL)
