Emerging Threathightest

Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 2350dbc08b-60ce-40f1-a6b6-346497e34c882023
Emerging Threat
Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        OriginalFileName:
            - 'Cmd.Exe'
            - 'powershell_ise.EXE'
            - 'powershell.exe'
        Image|endswith: '\wermgr.exe'
    condition: selection
False Positives
Unlikely

False positives are unlikely for most environments. High confidence detection.

MITRE ATT&CK

Other

cve.2023-36874detection.emerging-threats
Rule Metadata
Rule ID
50dbc08b-60ce-40f1-a6b6-346497e34c88
Status
test
Level
high
Type
Emerging Threat
Created
Wed Aug 23
Path
rules-emerging-threats/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml
Raw Tags
attack.executioncve.2023-36874detection.emerging-threats
View on GitHub