Emerging Threathightest

Potential CVE-2023-36874 Exploitation - Fake Wermgr.Exe Creation

Detects the creation of a file named "wermgr.exe" being created in an uncommon directory. This could be a sign of potential exploitation of CVE-2023-36874.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Wed Aug 23Updated Mon Jan 13ad0960eb-0015-4d16-be13-b3d9f18f13422023

Emerging Threat

Active Threat

Developed to detect an active or emerging threat. Prioritize investigation of any alerts and correlate with threat intelligence.

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '\wermgr.exe'
    filter_main_locations:
        TargetFilename|contains:
            - ':\$WINDOWS.~BT\NewOS\'
            - ':\$WinREAgent\' # From "wuauclt.exe"
            - ':\Windows\servicing\LCU\'
            - ':\Windows\System32\'
            - ':\Windows\SysWOW64\'
            - ':\Windows\WinSxS\'
            - ':\WUDownloadCache\' # Windows Update Download Cache
            - ':\Windows\SoftwareDistribution\Download\'
    condition: selection and not 1 of filter_main_*