Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

 1title: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
 2id: ad0960eb-0015-4d16-be13-b3d9f18f1342
 3status: experimental
 4description: Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.
 5references:
 6    - https://github.com/Wh04m1001/CVE-2023-36874
 7    - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2023/08/23
10tags:
11    - attack.execution
12    - cve.2023.36874
13    - detection.emerging_threats
14logsource:
15    category: file_event
16    product: windows
17detection:
18    selection:
19        TargetFilename|endswith: '\wermgr.exe'
20    filter_main_locations:
21        TargetFilename|contains:
22            - ':\$WINDOWS.~BT\NewOS\'
23            - ':\Windows\servicing\LCU\'
24            - ':\Windows\System32\'
25            - ':\Windows\SysWOW64\'
26            - ':\Windows\WinSxS\'
27            - ':\WUDownloadCache\' # Windows Update Download Cache
28    condition: selection and not 1 of filter_main_*
29falsepositives:
30    - Unknown
31level: high

References

• GitHub - Wh04m1001/CVE-2023-36874

  

  Contribute to Wh04m1001/CVE-2023-36874 development by creating an account on GitHub.

  
  Read More

• Falcon Complete: Zero-Day Exploit Case Study | CrowdStrike

  

  The Falcon Complete MDR team discovered and blocked a zero-day exploit (CVE-2023-36874) affecting Windows Error Reporting. Learn more about the discovery and response!

  
  Read More

Related rules

• Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
• Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
• CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
• CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
• CVE-2023-40477 Potential Exploitation - .REV File Creation