Windows Error Manager/Reporting Masquerading

[rule]
description = """
Identifies suspicious instances of the Windows Error Reporting process (WerFault.exe or Wermgr.exe) with matching
command-line and process executable values performing outgoing network connections. This may be indicative of a
masquerading attempt to evade suspicious child process behavior detections.
"""
id = "3d16f5f9-da4c-4b15-a501-505761b75ca6"
license = "Elastic License v2"
name = "Windows Error Manager/Reporting Masquerading"
os_list = ["windows"]
reference = ["https://www.elastic.co/security-labs/revisiting-blister-new-developments-of-the-blister-loader"]
version = "1.0.34"

query = '''
sequence by process.entity_id with maxspan=5m
  [process where event.action == "start" and
   process.name : ("wermgr.exe", "WerFault.exe") and process.args_count == 1 and process.parent.executable != null and
   not (process.args : "C:\\WINDOWS\\system32\\wermgr.exe  -upload" and process.parent.executable : "C:\\Windows\\System32\\svchost.exe")]
  [network where event.action == "connection_attempted" and process.name : ("wermgr.exe", "WerFault.exe")]
'''

min_endpoint_version = "7.15.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1036"
name = "Masquerading"
reference = "https://attack.mitre.org/techniques/T1036/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"