Windows: Detect creation of fake wermgr.exe in uncommon directories

title: "Windows: Detect creation of fake wermgr.exe in uncommon directories"
id: e9148aa1-1821-4b37-9224-3b072c1ec521
status: test
description: This rule flags Windows file events where a target file ending with \wermgr.exe is created in locations that are not typically associated with legitimate system behavior. Attackers may use filename spoofing to disguise malicious payloads or persistence under a trusted-looking name. The detection relies on file creation telemetry with a captured TargetFilename, using directory-path filters to distinguish common from uncommon locations.
references:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
modified: 2025-01-13
tags:
  - attack.execution
  - cve.2023-36874
  - detection.emerging-threats
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \wermgr.exe
  filter_main_locations:
    TargetFilename|contains:
      - :\$WINDOWS.~BT\NewOS\
      - :\$WinREAgent\
      - :\Windows\servicing\LCU\
      - :\Windows\System32\
      - :\Windows\SysWOW64\
      - :\Windows\WinSxS\
      - :\WUDownloadCache\
      - :\Windows\SoftwareDistribution\Download\
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ad0960eb-0015-4d16-be13-b3d9f18f1342
    type: derived