Turla PNG Dropper Service Creation

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•20

This rule detects the creation of a service named 'WerFaultSvc' with EventID 7045 from the 'Service Control Manager' provider, which is associated with the Turla PNG dropper as reported by NCC Group in November 2018. This indicates potential persistence or privilege escalation by the Turla APT group.