Creation of WerFault.exe or Wer.dll in Unusual Folder

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•18

This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.