Windows File Creation of wermgr.exe in Uncommon Directory (Potential CVE-2023-36874)
Alerts on wermgr.exe creation in atypical Windows directories that may indicate filename spoofing.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-08-23
- Updated
- 2026-07-31
What it detects
This rule flags creation of a Windows file named wermgr.exe when it appears in directories that are not among common system locations. Attackers may place masquerading or payload files using a misleading executable name to blend in or enable subsequent execution. The detection relies on Windows file event telemetry that includes the target filename and its full path.
Reporting behind it
- github.comhttps://github.com/Wh04m1001/CVE-2023-36874
- crowdstrike.comhttps://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-detect-creation-of-fake-wermgr-exe-in-uncommon-directories-ad0960eb
title: Windows File Creation of wermgr.exe in Uncommon Directory (Potential CVE-2023-36874)
id: e9148aa1-1821-4b37-9224-3b072c1ec521
status: test
description: This rule flags creation of a Windows file named wermgr.exe when it appears in directories that are not among common system locations. Attackers may place masquerading or payload files using a misleading executable name to blend in or enable subsequent execution. The detection relies on Windows file event telemetry that includes the target filename and its full path.
references:
- https://github.com/Wh04m1001/CVE-2023-36874
- https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/file_event_win_exploit_cve_2023_36874_wermgr_creation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
modified: 2025-01-13
tags:
- attack.execution
- cve.2023-36874
- detection.emerging-threats
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: \wermgr.exe
filter_main_locations:
TargetFilename|contains:
- :\$WINDOWS.~BT\NewOS\
- :\$WinREAgent\
- :\Windows\servicing\LCU\
- :\Windows\System32\
- :\Windows\SysWOW64\
- :\Windows\WinSxS\
- :\WUDownloadCache\
- :\Windows\SoftwareDistribution\Download\
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: ad0960eb-0015-4d16-be13-b3d9f18f1342
type: derived