Suspicious Werfault.exe Network Connection Outbound

Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.

Sigma