Exclude WerFault Process Access.

Description

field win.eventdata.sourceImage="(?i)^C:\\\\Windows\\\\SysWOW64\\\\WerFault\.exe$|(?i)^C:\\\\Windows\\\\system32\\\\WerFault\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Dell\\\\UpdateService\\\\ServiceShell\.exe$" AND field win.eventdata.user="(?i)^NT AUTHORITY\\\\SYSTEM$"

No license declared

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 60000 Group of windows rules. anchor level 0
   decoded_as=windows_eventchannel AND field win.system.providerName="\.+"
2. 60004 Group of Windows rules for the sysmon channel. anchor level 0
   field win.system.channel="^Microsoft-Windows-Sysmon/Operational$"
3. 61600 Windows Sysmon informational event anchor level 0
   field win.system.severityValue="^INFORMATION$"
4. 61612 Sysmon - Event 10: process accessed by · win.system.eventID = 10 anchor level 0
   field win.system.eventID="^10$"
5. 109101 Sysmon - Event 10: ProcessAccess by · Credential Dumping (T1003) anchor level 3
   field win.eventdata.RuleName="^technique_id=T1003,technique_name=Credential Dumping$"
6. 900105 Exclude WerFault Process Access. exclusion level 1 this rule
   field win.eventdata.sourceImage="(?i)^C:\\\\Windows\\\\SysWOW64\\\\WerFault\.exe$|(?i)^C:\\\\Windows\\\\system32\\\\WerFault\.exe$|(?i)^C:\\\\Program Files \(x86\)\\\\Dell\\\\UpdateService\\\\ServiceShell\.exe$" AND field win.eventdata.user="(?i)^NT AUTHORITY\\\\SYSTEM$"

Rule dependencies

Depends on

• composes · Wazuh if_sid 109101
  • Sysmon - Event 10: ProcessAccess by · Credential Dumping (T1003)