Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.
Sigma rule (View on GitHub)
1title: Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation
2id: ad0960eb-0015-4d16-be13-b3d9f18f1342
3status: experimental
4description: Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.
5references:
6 - https://github.com/Wh04m1001/CVE-2023-36874
7 - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
8author: Nasreddine Bencherchali (Nextron Systems)
9date: 2023/08/23
10tags:
11 - attack.execution
12 - cve.2023.36874
13 - detection.emerging_threats
14logsource:
15 category: file_event
16 product: windows
17detection:
18 selection:
19 TargetFilename|endswith: '\wermgr.exe'
20 filter_main_locations:
21 TargetFilename|contains:
22 - ':\$WINDOWS.~BT\NewOS\'
23 - ':\Windows\servicing\LCU\'
24 - ':\Windows\System32\'
25 - ':\Windows\SysWOW64\'
26 - ':\Windows\WinSxS\'
27 - ':\WUDownloadCache\' # Windows Update Download Cache
28 condition: selection and not 1 of filter_main_*
29falsepositives:
30 - Unknown
31level: high
References
Related rules
- Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
- Potential CVE-2023-36874 Exploitation - Uncommon Report.Wer Location
- CVE-2023-38331 Exploitation Attempt - Suspicious Double Extension File
- CVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child Process
- CVE-2023-40477 Potential Exploitation - .REV File Creation