huntrule

Windows Process Execution: Renamed cmd/powershell/powershell_ise as wermgr.exe

Detects disguised execution of cmd or PowerShell by matching original file name with a wermgr.exe process image.

FreeUnreviewedSigmahighv1
title: "Windows Process Execution: Renamed cmd/powershell/powershell_ise as wermgr.exe"
id: 2f15916b-dc2b-44bd-9cf2-42381f2b31a0
status: test
description: This rule flags Windows process creation events where the original file name is cmd.exe, powershell.exe, or powershell_ise.exe, but the executed image ends with wermgr.exe. Renaming legitimate system utilities is a common attacker technique to disguise execution and hinder detection. It relies on Windows process creation telemetry that includes the process image path and the OriginalFileName metadata.
references:
  - https://github.com/Wh04m1001/CVE-2023-36874
  - https://www.crowdstrike.com/blog/falcon-complete-zero-day-exploit-cve-2023-36874/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-36874/proc_creation_win_exploit_cve_2023_36874_fake_wermgr.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-23
tags:
  - attack.execution
  - cve.2023-36874
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName:
      - Cmd.Exe
      - powershell_ise.EXE
      - powershell.exe
    Image|endswith: \wermgr.exe
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 50dbc08b-60ce-40f1-a6b6-346497e34c88
    type: derived

What it detects

This rule flags Windows process creation events where the original file name is cmd.exe, powershell.exe, or powershell_ise.exe, but the executed image ends with wermgr.exe. Renaming legitimate system utilities is a common attacker technique to disguise execution and hinder detection. It relies on Windows process creation telemetry that includes the process image path and the OriginalFileName metadata.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.