detection.wiki

Detection rules › Sigma

Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution

Status
test
Severity
high
Log source
product windows, category process_creation
Author
Nasreddine Bencherchali (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874

MITRE ATT&CK coverage

TacticTechniques
ExecutionNo specific technique

Event coverage

ProviderEventTitle
SysmonEvent ID 1Process creation

Rule body yaml

title: Potential CVE-2023-36874 Exploitation - Fake Wermgr Execution
id: 50dbc08b-60ce-40f1-a6b6-346497e34c88
status: test
description: Detects the execution of a renamed "cmd", "powershell" or "powershell_ise" binary. Attackers were seen using these binaries in a renamed form as "wermgr.exe" in exploitation of CVE-2023-36874
references:
    - https://github.com/Wh04m1001/CVE-2023-36874
    - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-08-23
tags:
    - attack.execution
    - cve.2023-36874
    - detection.emerging-threats
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        OriginalFileName:
            - 'Cmd.Exe'
            - 'powershell_ise.EXE'
            - 'powershell.exe'
        Image|endswith: '\wermgr.exe'
    condition: selection
falsepositives:
    - Unlikely
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    OriginalFileName:
        - 'Cmd.Exe'
        - 'powershell_ise.EXE'
        - 'powershell.exe'
    Image|endswith: '\wermgr.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Imageends_with
  • \wermgr.exe corpus 5 (sigma 5)
OriginalFileNameeq
  • Cmd.Exe corpus 65 (sigma 43, splunk 17, elastic 5)
  • powershell.exe corpus 120 (sigma 84, splunk 30, elastic 6)
  • powershell_ise.EXE corpus 51 (splunk 30, sigma 18, elastic 3)