Potential ReflectDebugger Content Execution Via WerFault.EXE

Title: Potential ReflectDebugger Content Execution Via WerFault.EXE
Status: test
Description:Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow
References:
  -https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html
  -https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
Author: X__Junior (Nextron Systems)
Date: 2023-06-30
modified:None
Tags:

• -'attack.execution'
• -'attack.stealth'
• -'attack.t1036'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_img:
Image|endswith:'\WerFault.exe' OriginalFileName:'WerFault.exe'   selection_cli:
    CommandLine|contains: ' -pr '
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium